Members of the covered entitys (CE) maintenance team improperly disposed of four boxes of paper records containing the protected health information (PHI) of approximately 12,450 individuals in wrongdoing during the course of an office move within the building. The junk was collected by the CEs trash removal vendor the next day and transported to a recycling plant. The PHI involved in the cut included names, addresses, identification numbers (including social security numbers), home phone numbers, physician information, health aid plans, and radical numbers. The CE was not able to determine whether or not someone at the recycling center may have acquired or viewed the PHI. The CE, Independence blue Cross, provided plug notification to HHS, the media, and affected individuals. The CE offered all members who had their penis recognition number compromised i year of free credit monitoring. As a result of OCRs investigation, the ce revised its policies and procedures for junk disposal, as well as maintenance and disposal of provider reports. The ce also sent a reminder to all associates regarding its policies and procedures for proper handling of paper documents and proper disposal of trash and documents containing PHI. Furthermore, the ce sanctioned the employees responsible for the incident. The ce initiated plans to provide additional staff training on its HIPAA policies and procedures for trash disposal. placement of hacked information: Paper/Films Business associate present: No