HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of May 4, 2012.
- Organization as reported
- Baptist Health System, AL
- Entity type as reported
- Healthcare Provider
- Category as reported
Improper Disposal
- Location of information as reported
- Paper/Films
- Submission date
- May 4, 2012
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15637, row:6776)
- Archived copy
- Held in the private archive (provenance)
On March 8, 2012, a trash bag containing discarded appointment schedules was inadvertently removed from a “shred bin” at Baptist Health System’s Talladega clinic by the office cleaning service and disposed of in a dumpster without being shredded. The protected health information (PHI) involved in the breach included patients’ names, dates of birth, dates of service, account numbers, and chart numbers for approximately 2,000 individuals. The CE provided breach notification to affected individuals, the media, and HHS. Following the breach, the CE initiated an internal investigation, conducted a risk assessment, and updated its policies and procedures regarding access to shred bins. As a result of OCR’s investigation, the CE reviewed its policies and procedures with staff to ensure the adequacy of safeguards.