Lane County Health & Human Services

Lane County Health and Human Services discovered during the course of a routine records search that it was unable to account for a total of 49 boxes of archived medical records that it kept within a secure warehouse. This potentially compromised the PHI of 715 patients, including clinical, demographic, and financial information. The covered entity (CE) provided breach notification to HHS, affected individuals, and the media. To prevent a similar breach from happening in the future, the CE implemented and established new policies and procedures for storing and destroying medical records and contracted with a company to assist in recording, tracking, archiving, and destroying its records. The CE enhanced physical security and retrained staff on its updated HIPAA policies and procedures subsequent to the breach incident. OCR obtained assurances that the CE implemented the corrective actions steps listed above.