Radiology Regional Center, PA

On December 19, 2015, 12 boxes containing 483,063 patients’ records fell off of the business associate’s (BA) truck and onto the street while being transported to the incinerator. The types of PHI in the records included patients’ names, addresses, dates of birth, social security numbers, claims information, credit card/bank information, diagnosis codes, lab results, and treatment information. The CE provided breach notification to HHS, affected individuals, and the media and also posted substitute notice on its website. It also activated a call center on January 12th, 2016, which provided information about the breach for 90 days, and provided identity protection for one year to the affected individuals. In response to the incident, the CE opened an internal investigation and interviewed all relevant staff and its business associate. The CE ended its business relationship with the BA, Lee County Solid Waste Division, and improved safeguards by changed the process for records’ destruction. OCR obtained assurances that the CE implemented the corrective actions listed above.