Planned Parenthood Southwest Ohio

On October 1, 2014, the Covered Entity (CE) mistakenly disposed of binders containing protected health information (PHI). The CE’s archived prescription dispensing logs and waived lab test logs were left in an unlocked closet after business hours and a custodian mistakenly put them in a trash dumpster. The following morning, the dumpster was emptied by the trash collector who took it to be buried with other garbage at a landfill that same day. The PHI involved in the incident included the names, dates of birth, lab results, and medications of approximately 5,000 individuals. After the CE filed the breach report, it determined that the incident was a non-reportable breach based on a four-part breach assessment and a low probability that the PHI in the binders had been compromised. The CE stated that its breach filing to OCR was not untimely, but was made in error. The CE conducted an investigation, re-trained all staff regarding its HIPAA policies and procedures, completed on-site HIPAA compliance audits, and implemented a new policy to address bulk trash removal from the health centers. OCR obtained written assurances that the voluntary actions of the CE listed above were taken.