Haywood County NC

On or around October 31, 2014, a paper accounts receivable report went missing from the covered entity’s (CE) billing office. The report contained the protected health information (PHI) of 955 individuals and included patients’ internal identification numbers, names, clinics visited, and amounts owed. The CE provided breach notification to HHS, affected individuals, and the media, and set up a toll free number answer line and e-mail contact. In response to the incident, the CE conducted an internal investigation and also contacted law enforcement and asked them to investigate. As a result of its investigation, the CE enhanced the physical security for the billing office, provided locked file cabinets, and restricted access to that office. In addition, the CE retrained staff, updated the roles and responsibilities for its HIPAA officer, and reviewed all HIPAA policies and procedures. As part of this investigation, OCR obtained and reviewed the CE’s relevant HIPAA policies and procedures and documentation of staff training.