SwedishAmerican Health System

An individual misrepresented himself as an employee of a vendor contracted with the covered entity (CE) to dispose of x-ray films, obtained access to a storage area that contained films to be destroyed, and stole approximately 1,500 x-ray films from the CE. The CE strongly believes that the films were stolen due to silver content rather than patient information. The protected health information (PHI) involved in the breach included names, addresses, dates of birth, medical record numbers, account numbers and x-ray types. The CE provided breach notification to HHS and the media and posted substitute notice online. Following the breach, the CE examined its policies and procedures, established a committee to oversee PHI destruction processes, reviewed physical security on campuses, and issued email notices to all workforce members regarding vendor security. OCR reviewed the CE’s policies and procedures.