A former employee mistakenly took home a basket of items, including documents containing the protected health information (PHI) of 727 patients, which were flagged for shredding. The documents were taken to an elementary school with other materials that had been stored at the employee's home for the summer. The PHI included social security numbers, diagnosis codes, guardians’ names and phone numbers, supervisor recommendations concerning treatment, and insurance identification codes. The covered entity (CE), Seven Counties Services, provided breach notification to HHS, affected individuals, and the media, placed a conspicuous notice on its website, and set up a toll free information number. The CE investigated the breach and interviewed all involved individuals. As a result of OCR’s investigation, the CE developed new HIPAA awareness training focused on protecting paper records, revised its HIPAA policies and procedures regarding the disposal of documents containing PHI, and retrained staff on the new policies and procedures.
