HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Dec. 23, 2015.
- Organization as reported
- Allina Health, MN
- Entity type as reported
- Healthcare Provider
- Category as reported
Improper Disposal
- Location of information as reported
- Paper/Films
- Submission date
- Dec. 23, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14644, row:5783)
- Archived copy
- Held in the private archive (provenance)
On October 27, 2015, the covered entity (CE), Alina Health, discovered that its janitorial vendor erroneously placed its patients’ protected health information (PHI) in the trash dumpster. The breach affected 6,195 individuals and the types of PHI involved included financial, demographic, and clinical information. The CE provided notification of the breach to HHS, affected individuals, and the media and also posted substitute notice on its website. Following the breach, the CE investigated the breach, updated its physical safeguards policy, and educated its workforce on its updated policy. OCR obtained a copy of the CE’s business associate agreement with Iron Mountain for PHI disposal services. OCR obtained documented assurances that the CE implemented the corrective actions taken in response to this breach incident.