North Carolina Department of Health and Human Services - Division of State Operated Health Care Facilities

The covered entity (CE), North Carolina Department of Health and Human Services Division of State Operated Health Care Facilities, impermissibly disclosed the protected health information (PHI) of 1,315 individuals by exposing their PHI on its website, NC Open Book, without authorizations. The PHI involved in the breach included patient payment information, names, addresses, and facility names, which were erroneously posted as vendor payments on the website. The CE removed the information from the website immediately upon discovery. The CE also provided breach notification to HHS, affected individuals, and the media, and placed substitute notice on its website. In addition, the CE provided a toll-free phone number for affected individuals to obtain additional information. Following the breach the CE implemented procedures limiting the types of personally identifiable information that are disclosed in the accounting system. Additionally, the CE improved safeguards for all HIPAA-related documents and email correspondence containing PHI. Finally, the CE implemented a procedure that requires prior review of any data being released to the public and redaction of confidential information. OCR obtained assurances that the corrective actions listed above were completed.