Allina Health System

Allina Health System (MN) reported to HHS on 2024-05-06 an Unauthorized Access/Disclosure affecting 715 individuals. An employee impermissibly accessed the PHI of those individuals via Electronic Medical Record systems. PHI involved included demographic, financial, and clinical information. The covered entity notified HHS, affected individuals, and the media, and implemented additional administrative, technical, and security safeguards.

Allina Health reported to HHS on 2023-04-28 a Unauthorized Access/Disclosure affecting 1042 individuals. Breached information located on Network Server.

Allina Health reported to HHS on 2020-09-11 a Hacking/IT Incident affecting 199,389 individuals. Breached information located on Network Server. A business associate experienced a ransomware attack affecting ePHI including names, addresses, DOB, email, phone, and treatment info. CE notified HHS, individuals, and media.

Allina Health System (Minneapolis Heart Institute) reported to HHS OCR on 2017-02-23 an Improper Disposal breach affecting 776 individuals. PHI on Paper/Films was placed in a recycling bin and emptied rather than shredded as planned. Breach was discovered on January 20, 2017. Exposed PHI included names, addresses, dates of birth, SSNs, Medicare IDs, insurance IDs, clinical diagnoses, and lab results. OCR obtained assurances that corrective actions — new policies, procedures, and employee training — were implemented.

Allina Health (MN) reported to HHS on 2015-12-23 an Improper Disposal breach affecting 6,195 individuals. On October 27, 2015, a janitorial vendor erroneously placed patients' PHI in a trash dumpster; breached information was on Paper/Films and included financial, demographic, and clinical data. The CE updated its physical safeguards policy, educated staff, and worked with Iron Mountain (its PHI disposal BA) on corrective actions. OCR confirmed implementation of remediation measures.

Allina Health reported that it erroneously mailed letters and preventative screening kits to incorrect recipients, affecting 838 individuals. The protected health information involved included individuals' names. The incident, reported on April 6, 2015, involved paper documents and films. In response, the company retrained employees and implemented a new, more secure mailing workflow.

Allina Health reported to HHS on 2013-11-04 a Unauthorized Access/Disclosure affecting 3807 individuals. Breached information located on Electronic Medical Record. An employee improperly accessed PHI including names, addresses, DOB, medical conditions, medications, and lab results.