Amedisys Notifies Patients of Improper Disposal Incident
The medical information of certain patients of Amedisys Home Health of Fayetteville, NC has been disposed of improperly, although all information is believed to have been retrieved.
Amedisys ensures all paper copies of patients’ protected health information is shredded and rendered unreadable, indecipherable, and otherwise cannot be reconstructed, in accordance with HIPAA Rules.
However, Baton Rouge, LA-based Amedisys was recently informed that two shredding bins had been found behind a Fayetteville business and had not shredded in accordance with company policies. The bins should have been taken to a recycling center where the documents could be securely shredded.
After being notified of the HIPAA breach, Amedisys arranged for the bins to be retrieved. A full inventory of the documents was then performed to determine whether patients’ protected health information was present in the documents and which patients had PHI exposed. The documents were discovered to contain patients’ names, demographic information and some medical information related to the services provided by Amedisys.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Out of an abundance of caution, all patients impacted by this incident will be offered identity theft protection services, although Amedisys does not believe any of the information in the documents has been accessed by unauthorized individuals other than by the individuals who discovered and reported their find. It also did not appear as if any documents had been removed from the bins, although the possibility cannot be ruled out.
Since the bins were found behind a local business, out of eyesight of the public, it is not believed that anyone other than the individuals who found the documents knew they were there.
An internal investigation is now being conducted by Amedisys to determine how the documents failed to make it to the shredding facility. A review of policies and procedures covering the shredding of sensitive documents is also being conducted. Amedisys will extend that review to the vendor used to collect and shred documents and the subcontractor used to service Amedisys Home Health of Fayetteville.
All patients impacted by the incident are now being notified of the potential privacy violation by mail.
