Baptist Health System

On March 8, 2012, a trash bag containing discarded appointment schedules was inadvertently removed from a “shred bin” at Baptist Health System’s Talladega clinic by the office cleaning service and disposed of in a dumpster without being shredded. The protected health information (PHI) involved in the breach included patients’ names, dates of birth, dates of service, account numbers, and chart numbers for approximately 2,000 individuals. The CE provided breach notification to affected individuals, the media, and HHS. Following the breach, the CE initiated an internal investigation, conducted a risk assessment, and updated its policies and procedures regarding access to shred bins. As a result of OCR’s investigation, the CE reviewed its policies and procedures with staff to ensure the adequacy of safeguards.