HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Nov. 21, 2012.
- Organization as reported
- Digital Archive Management, TX
- Entity type as reported
- Business Associate
- Category as reported
Improper Disposal, Theft
- Location of information as reported
- Network Server, Paper/Films
- Submission date
- Nov. 21, 2012
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15531, row:6670)
- Archived copy
- Held in the private archive (provenance)
On or about July 26, 2012, the covered entity (CE), El Centro Regional Medical Center, learned that its business associate (BA), Digital Archive Management, abandoned the CE’s hard copy “jackets” for radiology films (x-rays) and radiology reports at a locked El Centro facility, instead of digitizing and destroying the records in accordance with the Business Associate Agreement. The CE recovered the jackets and radiology reports. On March 22, 2013, the CE learned from the FBI that the missing radiology films and hard copy paper documents were discovered in an abandoned commercial facility in Nevada. The breach involved the protected health information (PHI) of approximately 501 individuals and included demographic Information, including names and dates of birth and clinical information, including diagnoses and conditions. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE sanctioned certain employees, reviewed and updated its HIPAA policies and procedures, and implemented security measures to reduce risks and vulnerabilities to PHI and ePHI. The breach incident involved a BA and occurred prior to the September 23, 2013, compliance deadline. OCR verified that the CE had a proper BA agreement in place that restricted the BA’s use and disclosure of PHI and required the BA to safeguard all PHI. OCR also reviewed the CE’s policies and procedures, risk analysis, risk management plan, and incident report.