Florida Hospital Medical Group

In the process of transferring over 7,000 boxes of the covered entity’s patient records from Access Record Storage Company to Iron Mountain, a total 139 boxes of paper medical records went missing.The covered entity (CE), Florida Hospital Medical Group, discovered on August 17, 2016, that 80 boxes of patient records were missing from its Iron Mountain storage facility. Additionally, on October 6, 2016, the CE discovered that another 59 boxes were reported missing from its Access Record Storage Company facility. The boxes included patients’ clinical health information, financial claims information, addresses, dates of birth, driver’s license numbers, names, and social security numbers. Approximately 6,786 individuals were affected. In response to the breach, the CE commenced an investigation in coordination with both business associates (BAs). Moreover, the CE evaluated the record transfer process and implemented process improvements. The also CE improved its purchasing department processes for vendor management and implemented policies and procedures to train future storage vendors. Furthermore, the CE provided its leadership with additional education and awareness training regarding HIPAA privacy. OCR obtained assurances that the CE implemented the corrective actions listed above.