The covered entity's (CE) contracted janitorial service comingled the regular trash with shred bin materials containing the protected health information (PHI) of approximately 842 individuals that were ultimately disposed of in the general trash receptacle. The types of PHI involved included patients’ names, addresses, birthdates, claims information, diagnoses, conditions, lab results and medications. The CE provided breach notification to HHS, affected individuals, and the media and also provided a toll-free number and free identity theft protection services. The CE required the contractor to remind staff not to dispose of the documents in the shred bins and retrained staff specific to HIPAA. OCR obtained assurances that the CE implemented the corrective actions noted above.
