HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 9, 2018.
- Organization as reported
- Arthritis & Osteoporosis Consultants of the Carolinas, NC
- Entity type as reported
- Healthcare Provider
- Category as reported
Improper Disposal
- Location of information as reported
- Paper/Films
- Submission date
- Nov. 9, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13632, row:4771)
- Archived copy
- Held in the private archive (provenance)
On September 10, 2018, an employee of the covered entity (CE), Arthritis and Osteoporosis Consultants of the Carolinas, improperly disposed of protected health information (PHI) in a trash can instead of the shred bin. The breach affected 3,930 individuals and included patients’ names, dates of birth, insurance information, and treating physicians. For some patients, the PHI included the name of an infusion drug, and for Medicare patients, it included their social security numbers. To prevent a similar breach from happening in the future, the CE provided additional shred bins throughout the office, briefed all their employees on the incident, and advised them on best practices for handling and disposing of PHI. Additionally, the CE provided sanctions and retraining for the clerk responsible for the breach. In response to OCR’s investigation, the CE reviewed its data retention and destruction policies. The CE provided breach notification HHS, affected individuals, and the media.