Seattle - King County Department of Public Health

The covered entity (CE), Public Health, Seattle & King County, discovered that the protected health information (PHI) of 450 to 750 clients was inadvertently disposed of improperly by being put in the regular recycling. The PHI involved in the breach included treatment or medical condition information, and may have included the social security numbers of five individuals. The CE provided breach notification to HHS, the media, and 2,300 individuals who had an appointment at the subject clinic during the four weeks prior to the incident. It also provided substitute notification. The CE improved safeguards by updating its PHI disposal policies and procedures. OCR’s investigation confirmed that the appropriate notifications were made, that corrective actions steps were taken, and required that the CE retrain all staff on its revised disposal policy.