Rose Medical Center

A newly hired janitorial service mistakenly disposed of information face sheets awaiting removal from the covered entity’s (CE) Breach Center to shredding bins before the face sheets could be shredded. The face sheets belonged to the CE, Rose Medical Center, a Hospital Corporation of America facility, and contained protected health information (PHI), including demographic information, social security numbers, insurance information, physician information and next of kin contact information for approximately 606 individuals. The CE provided timely written notice to affected individuals, HHS, and the media. As a result of OCR’s investigation, the CE instituted a new procedure whereby all documents containing PHI must be disposed of directly into secured shredding bins, rather than recycling bins. The CE also launched a company-wide initiative to implement improved procedures to safeguard social security numbers, such as removing the numbers from documents where possible, and minimizing the printing of documents containing such PHI. The CE also retrained staff on the HIPAA Privacy Rule. Finally, the CE’s Breast Center ceased printing duplicate face sheets and full social security numbe