Family & Cosmetic Dentistry of the Rockies

The covered entity (CE), Family & Cosmetic Dentistry of the Rockies, reported that on September 18, 2017, it learned that its business associate (BA), a document shredding vendor, did not properly secure a container that held paper records to be shredded. Some of the documents, which contained clinical, demographic, and financial information, fell out of the container while they were being transported back to the shredding facility. The CE was able to recover most of the documents, but it could not be certain whether all of the documents were recovered. The CE provided breach notification to HHS, the 1,850 potentially affected individuals and the media. It also suspended its agreement with the BA and retained a different BA to conduct shredding services. OCR also provided the CE with technical assistance regarding its Privacy Rule policies and procedures.