Patient Records Missing from Iron Mountain Facility

Several boxes of medical records are missing from an Iron Mountain, Inc., storage facility in Atlanta. The records belong to Harbin Clinic, LLC, a physician group with 21 offices in northwestern Georgia. Iron Mountain, one of the largest physical and digital data storage companies in the world, reported the records cannot be accounted for and are missing or destroyed, Harbin Clinic said in its statement.

The missing records, 498 in all, contain the PHI of obstetrics, gynecology, and cardiovascular patients who received services prior to 2002. PHI in the records may include:

• Addresses
• Diagnoses
• Insurance information
• Names and dates of birth
• Social Security numbers

Harbin Clinic asks that any patients who believe they may be affected the breach contact them. The clinic also advises potentially affected patients to read the Federal Trade Commission’s identity theft information.

Although this breach falls just short of the 500-record mark, which would automatically trigger an investigation, the Office for Civil Rights recently announced that it has instructed its regional offices to increase investigations of smaller breaches. Regional offices will pay particular attention to smaller breaches that involve the theft or improper disposal of PHI.