Between April 19, 2016 and May 10, 2016, iron Mountain, a business colligate (BA) of the covered entity (CE), tx health and Human Services Commission, was unable to locate sixteen cartons of records containing protected health information (PHI). The types of PHI involved in the hack included the names, addresses, social security numbers, social surety claim numbers, dates of birth, medical record numbers, Medicaid/individual numbers, showcase numbers, and cant account numbers for over 500 individuals. The ce provided cut notification to HHS, affected individuals, and the media. following the incident, the ce ensured that the BA retrained its workforce members on privacy and capture storehouse and tracking procedures. Additionally, the CE initiated a alteration to its procedure for reconciling file inventories and verifying file box destruction. OCR obtained assurances that the CE implemented the corrective actions noted above. Location of hacked information: Paper/Films business relate present: No