Mecklenburg County, North Carolina

Mecklenburg County, North Carolina, the covered entity (CE), disclosed multiple digital storage disks (i.e., DVDs) that contained protected health information (PHI) when it responded to the public records requests of two media outlets. The breach affected 2,041 individuals and the PHI included patients’ names, information regarding the services received, lab results, medical record numbers, patients’ addresses, and dates of birth. The CE provided timely breach notification to HHS, to affected individuals, and to the media. The CE also posted notification about the breach to its website. In response to the breach, the CE revised its HIPAA policies and procedures, revised training modules, retrained staff, and allocated funds to purchase software and hardware to improve its management of future public records requests. OCR provided technical assistance to the CE regarding the required elements of breach notification notices. OCR obtained assurances that the CE implemented the corrective actions listed above.