HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Jan. 25, 2018.
- Organization as reported
- Rocky Mountain Women's Health Center, Inc., UT
- Entity type as reported
- Healthcare Provider
- Category as reported
Improper Disposal
- Location of information as reported
- Paper/Films
- Submission date
- Jan. 25, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13933, row:5072)
- Archived copy
- Held in the private archive (provenance)
On December 4, 2017, the covered entity (CE), Rocky Mountain Women’s Health Center, Inc., discovered that, on or about July 31, 2015, certain documents had been accidently left in office space that it no longer occupies. The CE stopped operating a clinic in the space in 2012, but its business associate (BA) used the space for billing and payment-related services on its behalf until July 31, 2015. The abandoned records contained 1,123 patients’ protected health information (PHI) and included paper records, receipts for payment, copies of checks, internal practice reports, and copies of medical records or other records that indicated diagnosis or medical history information. The types of PHI in these documents included demographic, financial, and clinical information. The CE provided breach notification to HHS, affected individuals, and the media and offered a free year of credit monitoring. Following the breach, the CE revised its procedures for vacating space to include a final walk through to check for remaining charts or other patient information, trained staff with a focus on record retention and disposal, and developed a new record removal policy and procedure. OCR obtained assurances that the CE implemented the corrective actions noted above.