Community Mercy Health Partners (covered entity) reported to HHS OCR that law enforcement officials discovered paper records belonging to the CE in a dumpster, affecting 113,528 individuals. Records related to lab studies and contained demographic and clinical information including names, addresses, DOBs, driver's license info, SSNs, diagnoses, lab results, medications, and other treatment data. A subcontractor (Property Contractor) was responsible for the improper disposal. The CE provided notification, substitute web notice, and credit monitoring (for those with SSN/financial exposure), dismissed the subcontractor, retrained staff and the contractor, reduced long-term-storage records, and implemented new internal controls. OCR obtained assurances of corrective action.
Affected (this filing): 113,528