Greenwood Leflore Hospital

The covered entity (CE), Greenwood Leflore Hospital, discovered that an ex-employee of a business associate (BA) the CE used to recycle and destroy old x-ray films, stole x-ray films which contained the names, dates of birth and x-ray images of 3,750 patients. This individual’s employment had been terminated by the BA prior to the breach, and therefore he was not authorized to take possession of these x-ray films. The CE provided breach notification to HHS, affected individuals, and the media, and also posted substitute notice. In response to the breach, the CE filed a police report, attempted to recover the x-ray films, and sanctioned and re-trained the employees involved. The CE also filed a civil lawsuit against the individual who took the films. The individual was later arrested and found guilty of petit larceny and was ordered to pay restitution to the CE. The CE provided additional training to its entire workforce regarding its BA access and breach policies, and terminated its business relationship with the BA. OCR obtained the CE’s policies and procedures related to the cited Privacy Rule provisions, as well as documentation related to employee training on the Privacy and Security Rules.