OCR conducted an investigation of the covered entity (CE), Texas Health and Humans Services Commission (HHSC), after it reported that a workforce member improperly discarded several boxes containing protected health information (PHI) into a public dumpster. After being unable to retrieve all of the discarded boxes, HHSC conducted a forensic analysis of the workforce member’s computer and determined that the workforce member had access to approximately 1,842 patient files (number of individuals affected by the breach). The protected health information (PHI) involved included names, addresses, dates of birth, social security numbers, financial information, and treatment information. Upon discovering the breach, HHSC conducted an internal investigation and sanctioned the workforce member involved. As a result of OCR’s investigation, HHSC retrained all employees on the proper disposal of PHI. and provided notification to the affected individuals and the media. HHSC offered one year of free credit monitoring services to all affected individuals.
