Bloodworks Northwest

An employee of the covered entity (CE), Bloodworks Northwest, printed a report containing the protected health information (PHI) of 1,893 patients and left it on a desk overnight. When the employee returned the next morning, the printed report, which contained patients’ demographic and clinical information, was missing. The CE investigated the incident and improved safeguards by storing patient files in locked cabinets, updating its process for internal sharing of PHI, and enhancing its security rounds. The CE provided breach notification to HHS, affected individuals and the media and also posted notice on its website. OCR obtained assurances that the CE implemented the corrective actions noted above.