HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Aug. 1, 2018.
- Organization as reported
- Lane County Health & Human Services, OR
- Entity type as reported
- Healthcare Provider
- Category as reported
Loss
- Location of information as reported
- Paper/Films
- Submission date
- Aug. 1, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13732, row:4871)
- Archived copy
- Held in the private archive (provenance)
Lane County Health and Human Services discovered during the course of a routine records search that it was unable to account for a total of 49 boxes of archived medical records that it kept within a secure warehouse. This potentially compromised the PHI of 715 patients, including clinical, demographic, and financial information. The covered entity (CE) provided breach notification to HHS, affected individuals, and the media. To prevent a similar breach from happening in the future, the CE implemented and established new policies and procedures for storing and destroying medical records and contracted with a company to assist in recording, tracking, archiving, and destroying its records. The CE enhanced physical security and retrained staff on its updated HIPAA policies and procedures subsequent to the breach incident. OCR obtained assurances that the CE implemented the corrective actions steps listed above.