Geisinger Bloomsburg Hospital

Archived protected health information (PHI) for 3,101 individuals could not be located by the CE, Geisinger Bloomsburg Hospital, after it was acquired by Geisinger, although copies of the PHI were available. There was no evidence that the PHI had been impermissibly disclosed or stolen. OCR provided the CE with information on what constitutes a breach under the Breach Notification Rule. The CE posted notice on its website and notified the media and patients although there was no indication that PHI had been accessed, used, or disclosed. The CE also re-trained staff on safeguards and proper disposal of PHI and stated that additional corrective steps would be taken to reinforce privacy practices in its new facility.