Fayetteville VAMC

The covered entity (CE), Fayetteville VA Medical Clinic Optical Shop, impermissibly disclosed the protected health information (PHI) of approximately 1,094 individuals by placing consultation reports in the recycling bin rather than the shred bin from January to April 2013. The PHI involved in the breach included patients’ names, social security numbers, birthdates, addresses, and phone numbers. The CE provided breach notification to HHS, the media, and all potentially affected patients and also offered credit monitoring. The CE investigated the incident, removed and shredded all identified documents from the recycle bin, and provided a document shredder on-site. Additionally, the CE retrained employees regarding security and disposal methods for documents containing PHI. Moreover, the responsible staff member was sanctioned according to the CE’s policy. OCR obtained assurances that the corrective actions listed above were completed.