Digital Archive Management

On or about July 26, 2012, the covered entity (CE), El Centro Regional Medical Center, learned that its business associate (BA), Digital Archive Management, abandoned the CE’s hard copy “jackets” for radiology films (x-rays) and radiology reports at a locked El Centro facility, instead of digitizing and destroying the records in accordance with the Business Associate Agreement. The CE recovered the jackets and radiology reports. On March 22, 2013, the CE learned from the FBI that the missing radiology films and hard copy paper documents were discovered in an abandoned commercial facility in Nevada. The breach involved the protected health information (PHI) of approximately 501 individuals and included demographic Information, including names and dates of birth and clinical information, including diagnoses and conditions. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE sanctioned certain employees, reviewed and updated its HIPAA policies and procedures, and implemented security measures to reduce risks and vulnerabilities to PHI and ePHI. The breach incident involved a BA and occurred prior to the September 23, 2013, compliance deadline. OCR verified that the CE had a proper BA agreement in place that restricted the BA’s use and disclosure of PHI and required the BA to safeguard all PHI. OCR also reviewed the CE’s policies and procedures, risk analysis, risk management plan, and incident report.