Graybill Medical Group

A group of x-rays of poor quality were placed in the covered entity’s (CE) trash container for destruction. The cleaning personnel mistook the x-rays for regular trash and disposed of them in the usual manner. The CE, Graybill Medical Center, initiated an immediate search but the x-rays had already been taken to the landfill. The breach occurred on September 9, 2014, and affected 1,863 patients. The protected health information (PHI) contained patients’ names, addresses, dates of birth, physician/medical provider information, and, possibly, images of some areas of patients’ bodies. The CE provided breach notification to HHS, affected individuals and the media, and offered credit monitoring. Following the breach, the CE improved safeguards by ordering locked bins for x-rays that are to be destroyed, ordering covers for the PHI being transported, and implementing procedures requiring x-rays to be recycled weekly so as to more easily distinguish them from regular trash. The CE also retrained its workforce on its HIPAA policies. OCR obtained assurances that the CE implemented the corrective actions listed.