Vidant Health

Vidant Health, the covered entity (CE), discovered that it filed numerous bankruptcy documents, from December 1, 2007, through March 9, 2016, that listed protected health information (PHI) that was not necessary for the filing. The breach affected 897 individuals and included patients' billing account numbers, social security numbers, medical record numbers, dates of birth, telephone numbers, sex, marital status, names, service dates, and account balances. The CE sent timely breach notification to HHS, affected individuals, and the media and posted substitute notification on its website. The CE provided identity theft protection for affected individuals for one year. In response to the breach, the CE revised and redacted its bankruptcy filings, filed blanked protective orders, and sealed proofs of claims in the public record. It also retrained applicable staff. OCR obtained assurances that the CE implemented the corrective actions listed above.