Midland Women's Clinic

On April 26, 2016, the covered entity (CE), Midland Women’s Clinic, learned that patient documents had been discovered, unsecured, at an unauthorized offsite location. The documents contained the protected health information (PHI) of approximately 717 individuals and included names, dates of birth, social security numbers, addresses and zip codes, diagnoses/conditions, lab results, medications, and other treatment information. Following the breach, the CE secured the patient records, updated its policies and procedures, and provided additional HIPAA training to its employees. OCR reviewed the CE’s breach notifications to the affected individuals and the media and provided technical assistance regarding the breach notification requirements.