Community Mercy Health Partners

Community Mercy Health Partners, the covered entity, (the CE) reported that law enforcement officials found paper records belonging to the CE in a dumpster. The breach affected 113,528 individuals. The information consisted of records related to lab studies performed at the CE and included demographic and clinical information such as patient names, addresses, dates of birth, driver’s license information, social security numbers, diagnosis and condition information, lab results, medications and other treatment information. The CE responded to the breach by conducting an investigation to determine the cause of the breach; providing notice to those affected by the breach and providing substitute notice on its website; and offering free credit monitoring to individuals whose social security numbers or financial information may have been compromised by the breach. The CE took voluntary action to dismiss the subcontractor involved in the breach from all of its projects; re-educating the Property Contractor involved in the breach about business associate agreements and reiterating that training on the handling, storage, and disposal of PHI is required before each project begins; re-educating laboratory leaders and staff on records retention; immediately reducing the number of remaining records slated for long-term storage in accordance with its records retention and disposal policies; and implementing new internal controls to aid in the mitigation of risk. OCR obtained assurances that the CE implemented the corrective actions noted above.