HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 23, 2019.
- Organization as reported
- Cosmetic Surgery Specialists, P.C., PA
- Entity type as reported
- Healthcare Provider
- Category as reported
Improper Disposal
- Location of information as reported
- Paper/Films
- Submission date
- July 23, 2019
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13307, row:4446)
- Archived copy
- Held in the private archive (provenance)
A former business associate (BA), Health Claim Services, left billing records of the covered entity's (CE) patients in a storage facility where they were placed in a dumpster after the contents of the storage space were auctioned off due to non-payment. The former BA had been out of business for several years and its owner could not be found. The breached records included the protected health information (PHI) of 3,000 individuals and included names, home addresses, telephone numbers, health insurance information, and descriptions of services. Following the breach, the CE ensured that the storage facility shredded the records to prevent further disclosures. The CE provided breach notification to HHS, affected individuals, and the media. OCR provided technical assistance to the CE on the need to retain BA agreements for at least six years after the termination of a BA relationship.