Mount SInai Medical Center

OCR opened an investigation of the covered entity (CE), Mt. Sinai Medical Center, after it reported that a trash vendor placed two garbage bags in an open box containing the protected health information (PHI) of 1,586 patients outside the Mt. Sinai’s Department of Preventive Medicine’s facility with the regular trash. The PHI involved in the breach included names, dates of service, payer information, patients’ clinical information, mental health information and social security numbers. As a result of the breach, the CE retrieved the two trash bags and the box that contained PHI, provided training to its staff regarding appropriate disposal of PHI including paper files, and sanctioned the supervisor for failing to follow its policy regarding confidential waste. OCR provided TA to the CE regarding accounting of disclosures. CE assured OCR that the disclosures would be documented.