Western Wisconsin Medical Association, S.C. - River Falls Medical Clinics

The covered entity (CE), Western Wisconsin Medical Associates, discovered that, during the summer of 2012, an employee of a cleaning service used by River Falls Medical Clinic (“Clinic”) stole paper-based protected health information (PHI) of approximately 2,400 individuals, which was stored in unsecured bins for pick-up by a shredding company. The PHI involved in the breach included patients’ names and at least one of the following for each affected patient: date of birth, insurance account number, address, phone numbers, social security number, or medical number. The CE provided breach notification to HHS, the media, and affected individuals. The CE arranged for the provision of secure bins in which Clinic staff may dispose of paper PHI, developed new policies and procedures related to the disposal of PHI, and retrained relevant workforce members on the newly implemented policy and procedures.