HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Feb. 23, 2017.
- Organization as reported
- Allina Health System, MN
- Entity type as reported
- Healthcare Provider
- Category as reported
Improper Disposal
- Location of information as reported
- Paper/Films
- Submission date
- Feb. 23, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14263, row:5402)
- Archived copy
- Held in the private archive (provenance)
Allina Health System-Minneapolis Heart Institute, the covered entity (CE), discovered that protected health information (PHI) was placed in a recycling bin and emptied, instead of being shredded as planned. The breach was discovered on January 20, 2017, and affected approximately 776 individuals. The types of PHI involved included names, addresses, dates of birth, social security numbers, Medicare identification numbers, insurance identification numbers, clinical diagnoses, and lab results. The CE provided breach notification to affected individuals, HHS and the media. Following the breach, the CE implemented new policies and procedures and trained employees. OCR obtained assurances that the CE implemented the corrective actions noted above.