Hillsborough County Aging Services Department

A former employee found and returned a box of paper records containing protected health information (PHI) that had been missing for over five years and that belonged to the covered entity (CE), Hillsborough County Aging Services Department. The PHI included names, addresses, Social Security numbers, enrollment numbers, financial information, and clinical notes for 647 individuals. The CE reviewed and updated its policies and procedures to prevent any similar occurrences in the future, formalizing its procedures for safeguarding PHI outside of the office using password protected locked cases, and required all employees to review and implement the new procedures. The CE also provided breach notification to HHS, affected individuals, the media, and on its website. OCR obtained assurances that the CE implemented the corrective actions listed above.