HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Sept. 7, 2016.
- Organization as reported
- Decatur Health Systems, KS
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Paper/Films
- Submission date
- Sept. 7, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14433, row:5572)
- Archived copy
- Held in the private archive (provenance)
A CAT scan log binder containing protected health information (PHI) went missing from the covered entity (CE), Decatur Health Systems, sometime between July 22, 2016, and July 25, 2016. The breach affected 707 individuals and the types of PHI contained in the binder included patients’ names, dates of birth, exam dates, diagnoses, ordering providers, and x-ray exposure levels. The CE provided breach notification to HHS, affected individuals, and the media. It also reported the incident to the proper law enforcement authorities. In response to the breach the CE enhanced physical safeguards in every department. Additionally, the CE implemented new privacy and security practices and retrained staff on its HIPAA policies and procedures. The CE also revised its policy to clarify how patients and third parties can access PHI, including associated fees, and educated staff on the policy. OCR obtained documentation that the CE implemented the corrective actions noted above.