HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 22, 2014.
- Organization as reported
- Seven Counties Services, Inc., KY
- Entity type as reported
- Healthcare Provider
- Category as reported
Improper Disposal, Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- Oct. 22, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14949, row:6088)
- Archived copy
- Held in the private archive (provenance)
A former employee mistakenly took home a basket of items, including documents containing the protected health information (PHI) of 727 patients, which were flagged for shredding. The documents were taken to an elementary school with other materials that had been stored at the employee's home for the summer. The PHI included social security numbers, diagnosis codes, guardians’ names and phone numbers, supervisor recommendations concerning treatment, and insurance identification codes. The covered entity (CE), Seven Counties Services, provided breach notification to HHS, affected individuals, and the media, placed a conspicuous notice on its website, and set up a toll free information number. The CE investigated the breach and interviewed all involved individuals. As a result of OCR’s investigation, the CE developed new HIPAA awareness training focused on protecting paper records, revised its HIPAA policies and procedures regarding the disposal of documents containing PHI, and retrained staff on the new policies and procedures.