Cosmetic Surgery Specialists, P.C.

A former business associate (BA), Health Claim Services, left billing records of the covered entity's (CE) patients in a storage facility where they were placed in a dumpster after the contents of the storage space were auctioned off due to non-payment. The former BA had been out of business for several years and its owner could not be found. The breached records included the protected health information (PHI) of 3,000 individuals and included names, home addresses, telephone numbers, health insurance information, and descriptions of services. Following the breach, the CE ensured that the storage facility shredded the records to prevent further disclosures. The CE provided breach notification to HHS, affected individuals, and the media. OCR provided technical assistance to the CE on the need to retain BA agreements for at least six years after the termination of a BA relationship.