HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of June 1, 2017.
- Organization as reported
- North Dakota Department of Human Services, ND
- Entity type as reported
- Health Plan
- Category as reported
Improper Disposal
- Location of information as reported
- Paper/Films
- Submission date
- June 1, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14173, row:5312)
- Archived copy
- Held in the private archive (provenance)
North Dakota Department of Human Services, the covered entity (CE), reported a breach to HHS after it discovered that a workforce member had disposed of documents that included protected health information (PHI) in a dumpster. The documents contained PHI belonging to 2,452 individuals. The PHI included individuals’ first and last names, dates of birth, Medicaid provider numbers and other identifiers, dates of service, diagnosis codes, procedure codes, and billing information. The CE notified affected individuals and prominent media outlets of the breach. The CE also posted substitute notification on its website. The workforce member responsible for the breach resigned in lieu of termination. The CE trained its staff in proper disposal of PHI. As a result of OCR’s technical assistance, the CE revised its policies concerning safeguarding PHI, the provision of Privacy training, its sanctions policies, disclosures of PHI and its mitigation policy and provided OCR with written assurance that it will train all members of its workforce on the updated policies.