HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of April 16, 2014.
- Organization as reported
- Greenwood Leflore Hospital, MS
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Other
- Submission date
- April 16, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15111, row:6250)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Greenwood Leflore Hospital, discovered that an ex-employee of a business associate (BA) the CE used to recycle and destroy old x-ray films, stole x-ray films which contained the names, dates of birth and x-ray images of 3,750 patients. This individual’s employment had been terminated by the BA prior to the breach, and therefore he was not authorized to take possession of these x-ray films. The CE provided breach notification to HHS, affected individuals, and the media, and also posted substitute notice. In response to the breach, the CE filed a police report, attempted to recover the x-ray films, and sanctioned and re-trained the employees involved. The CE also filed a civil lawsuit against the individual who took the films. The individual was later arrested and found guilty of petit larceny and was ordered to pay restitution to the CE. The CE provided additional training to its entire workforce regarding its BA access and breach policies, and terminated its business relationship with the BA. OCR obtained the CE’s policies and procedures related to the cited Privacy Rule provisions, as well as documentation related to employee training on the Privacy and Security Rules.