HITS Scanning Solutions

The covered entity's (CE) business associate (BA) shipped microfilm records containing protected health information (PHI) of 7,059 workforce members. The microfilm was lost in transit and not recovered. The PHI included clinical information, diagnoses, names, addresses, zip codes, date of births, social security numbers, driver's license numbers, and other identifiers. Following the breach, the CE changed its procedures, requiring PHI to be shipped via a new mail carrier that requires a confirmation signature upon receipt and allows for the tracking of packages. As a result of OCR's investigation the CE retrained its employees on its HIPAA policies and procedures.