Welcome to the Nexus of Ethics, Psychology, Morality, Philosophy and Health Care

Welcome to the nexus of ethics, psychology, morality, technology, health care, and philosophy
Showing posts with label Data Breach. Show all posts
Showing posts with label Data Breach. Show all posts

Monday, July 30, 2012

Beth Israel Deaconess reveals health data breach

By Kyle Murphy, PhD
EHR Intelligence
Originally published July 20, 2012

The personal health information of close to 4,000 patients at Beth Israel Deaconess Medical Center (BIDMC) has been compromised after a physician’s personal laptop was stolen on May 22, says the Boston Globe. BIDMC officials could not be reached for comment.
 
 
Thanks to Ken Pope for this information.

Monday, July 9, 2012

Data breach leads to $1.7M fine for Alaska DHSS

By Erin McCann
Healthcare Finance News
Originally published June 27, 2012

The Alaska Department of Health and Social Services (DHSS) – the state’s Medicaid agency – has agreed to pay $1.7 million to the U.S. Department of Health and Human Services (HHS) to settle possible violations of the HIPAA Security Rule, making it the second largest settlement for HIPAA violations to date.

As part of the settlement, the state has also agreed to take corrective action to properly safeguard the electronic personal health information (PHI) of their Medicaid beneficiaries.

The HHS Office for Civil Rights (OCR) began its investigation following a breach report submitted by Alaska DHSS as required by the Health Information Technology for Economic and Clinical Health (HITECH) Act. The report indicated that a portable electronic storage device (USB hard drive) possibly containing PHI was stolen from the vehicle of a DHSS employee. PHI from an estimated 2,000 individuals was stored on the device.

The entire story is here.

Editorial Note: Please do not tranfer large amounts of personal data from a secure data bank to a jump drive, lap top or other portable storage device.

MD Anderson suffers data breach via stolen computer

By Beth Walsh
CMIO - Industry News
Originally published July 2, 2012

The University of Texas MD Anderson Cancer Center announced that a computer containing patient and research information was stolen from a physician’s home on April 30. The physician notified the local police department.

After learning of the theft on May 1, MD Anderson immediately began a thorough investigation, including working with outside forensics experts, to determine the information contained on the computer.

The entire story is here.

Tuesday, May 29, 2012

South Shore Hospital to pay $750,000 to settle data breach charges

By Hiawatha Bray
The Boston Globe
Originally published on May 25, 2012

It will cost South Shore Hospital in Weymouth $750,000 to settle charges related to a 2010 data breach that compromised the personal information of more than 800,000 people.

The settlement, approved Thursday in Suffolk Superior Court, included a civil penalty of $250,000 and $225,000 for a fund to be used by the office of Massachusetts Attorney General Martha Coakley to promote education on the protection of personal data. South Shore Hospital was also credited for $275,000 it spent on security measures following the breach.

The entire story is here.

Sunday, May 20, 2012

Utah hiring crisis team to manage health data breach

Personal Data: Health Agency ramps up efforts to help victims, rebuild public trust

By Kirsten Stewart
The Salt Lake Tribune
Originally published May 14, 2012

The state of Utah is hiring a public relations firm to handle "crisis communications" in the wake of a health data breach that put the personal information of 780,000 people at risk.

The contract will be short-lived and will cost between $100,000 and $200,000, according to a solicitation published on May 11.

It calls for building a communications plan to "rebuild trust with the public, specifically those who were directly impacted by the breach and those who rely on the [Utah Department of Health] for critical health services."


Thanks to Ken Pope for this lead.

Tuesday, May 1, 2012

Health records lost, stolen or revealed online

Health privacy problems persist a decade after law went into effect to protect patients

By Deborah Shelton
Chicago Tribune Reporter
Originally published April 23, 2012

Almost a decade after a new law went into effect to strengthen health privacy protections, the number of breaches of patient records and databases across the U.S. suggests that personal health information is not as private or secure as many consumers might want or expect.

Since fall 2009, more than 400 large health care breaches affecting at least 500 people and more than 50,000 smaller breaches have been reported to the federal government.

One of the largest unauthorized disclosures in recent history of medical records and other private information happened in September, when computer tapes were stolen that contained data on almost 5 million people enrolled in TRICARE, the nation's health program for military members, their families and retirees.

University Breach Settlement Approved

2 Years of Credit Monitoring Services Required

By Jeffrey Roman
Data Breach Today
Originally published April 18, 2012

A court has granted final approval of the settlement of a class action lawsuit against University of Hawaii stemming from five data breaches over a three-year period that affected nearly 96,000 individuals.

The settlement will provide those affected with two years of free credit monitoring and credit restoration services, according to a statement from the university. The settlement affects students, faculty, alumni, university employees and others whose data was exposed in the five breaches from 2009 to 2011.

The entire story is here.

UAMS investigating breach of patient information

By David Harten
Arkansas Online
Originally published 4/21/2012

The University of Arkansas for Medical Sciences is investigating a breach of patient information after a document wasn't properly redacted.

According to a release from UAMS, the investigation began after an unidentified physician sent financial information on a patient to someone outside the UAMS offices in mid-February. The physician failed to remove all identifiers of the patients, such as names, account numbers and dates of service, among others. Bank card, credit card or bank account numbers were not included in the released information.

Thursday, April 19, 2012

Patient ID information stolen at Memorial hospitals

by Bob LaMendola and Donna Gehrke-White
Florida Sun-Sentinel
Originally published on April 13, 2012

Patients of Memorial hospitals in south Broward County had their identities stolen by employees who wanted to use the information to make money filing phony tax returns, Memorial officials said Thursday.

Two employees have been fired and are under criminal investigation by federal agents for improperly gaining access to the patients' information, said Kerting Baldwin, a spokeswoman for tax-assisted Memorial Healthcare System, parent of five Memorial hospitals.

Memorial sent letters Thursday to about 9,500 patients whose identities may have been exposed by the two employees.

The entire story is here.

Thanks to Ken Pope for this information.

Security breach at North Shore Univ. Hospital

By Sarah Wallace
WABC-TV New York
Originally published on April 11, 2012

Eyewitness News has an exclusive investigation into a major security breach at one of the area's largest hospitals.


Eyewitness News has learned that patients at North Shore University Hospital have been notified that their private health records, including social security numbers and insurance information, have been stolen.
New York State Police are saying this is an ongoing and widespread probe.

The entire story is here.

Thanks to Ken Pope for this information.

Thursday, April 12, 2012

Medicaid clients’ data breached at Utah Department of Health

by Meredith Forrest Kulwicki and Zach Whitney
Salt Lake City Fox 13
Originally posted on April 4, 2012

The Utah Department of Health announced a data breach on Wednesday concerning Medicaid claims.

The initial breach appears to have happened on Friday, March 30 and information from 24,000 claims was accessed according to the Utah Department of Health (UDOH).

The server that was breached contained data related to Medicare claims.  Information such client names, addresses, birth dates, Social Security numbers, physician’s names, nation provider identifiers, tax identification numbers and procedure codes may have been accessed said the UDOH.

The entire story is here.

Howard University Data Breach due to Stolen Laptop

NBC Channel 4 in Washington.
Originally published on March 28, 2012


A heads up if you have personal information on file with Howard University Hospital.

The facility sent letters to more than 34,000 patients about a laptop stolen in January.

The entire story is here.

Editorial note:
This story is yet another example of protected health information data loss due to a stolen laptop. 

A guiding principle can be derived from multiple stories like this: Prevent data breaches by not taking PHI home in a laptop or portable storage device.

Sunday, April 8, 2012

The raid on your medical records

By Karen Angel
New York Daily News-Opinion
Originally Published April 1, 2012

After I got laid off from my job last November, I started shopping for health insurance and a funny thing happened: BlueCross BlueShield emailed me someone else’s application.

The only similarity between me and this other applicant was that we’re both named Karen. I live in New York; she lives in Virginia. We have different last names, different Social Security numbers, different health histories. I know this because all of it was contained in the application BlueCross emailed to me — and under federal law, all of it is supposed to be confidential.

By emailing me the other Karen’s health-insurance application, BlueCross violated the Health Insurance Portability and Accountability Act. An angry consumer could find plenty of grounds — breach of confidentiality, negligence — to sue.

The entire story is here.

Saturday, April 7, 2012

Sensitive personal information missing on 800,000 California residents

By Steven Harmon
Mercurynews.com
Originally published March 29, 2012

In a puzzling breach of security, computer storage devices containing identification information of 800,000 Californians using the state's child support services have disappeared.

The Department of Child Support Services reported Thursday the data devices were lost March 12 en route to California from the Colorado facilities of IBM, one of the contractors in charge of the storage devices.

Authorities have begun to notify customers by mail about the incident, warning them that the devices include names, addresses, Social Security numbers, driver's license numbers, names of health insurance providers and employers.

Monday, March 26, 2012

TRICARE Breach Victims Report Fraud

8 Class Action Lawsuits Pending
Consolidation Sought


By Howard Anderson

In the weeks following last year's TRICARE health information breach, some of the 4.9 million beneficiaries affected became victims of financial fraud tied to their credit cards or banking accounts. That new detail is included in an amended complaint tied to the original classaction lawsuit filed in the case, which claims the financial fraud is related to the breach incident.

Eight class action lawsuits have now been filed in the wake of the case. The breach involved the theft of unencrypted computer tapes containing personal information, including Social Security numbers, but not financial data, about TRICARE beneficiaries, officials with the military health program said last year. 

Tuesday, March 20, 2012

Tennessee insurer to pay $1.5 million for breach-related violations

BlueCross BlueShield agrees to pay HHS for HIPAA violations tied to 2009 breach that exposed data on 1 million members

Computerworld
Originally published March 13, 2012

A 2009 data breach that has already cost BlueCross BlueShield of Tennessee nearly $17 million got a little more expensive Tuesday.

The insurer today agreed to pay $1.5 million to the U.S. Department of Health and Human Services (HHS) to settle Health Insurance Portability and Accountability Act (HIPAA) violations related to the breach.

Under the settlement, BlueCross BlueShield has also agreed to review and revise its privacy and security policies and to regularly train employees on their responsibilities under the HIPAA of 1996.

The settlement is the first resulting from enforcement action taken by the HHS under Health Information Technology for Economic and Clinical Health (HITECH) breach notification requirements.

The notification rules require all HIPAA-covered entities to notify affected individuals of any breach involving their health information. It also requires them to notify the HHS and the media in cases where the breach affects more than 500 people.

Leon Rodriguez, director of the HHS Office for Civil Rights (OCR) said the settlement underscores the department's intent to vigorously enforce HIPAA's security and privacy rules.

"This settlement sends an important message that OCR expects health plans and health care providers to have in place a carefully designed, delivered, and monitored HIPAA compliance program," Rodriguez said in a statement.

Wednesday, March 14, 2012

Legal Risks of Going Paperless

By Alicia Gallegos
Originally published March 5, 2012

Defense attorney Catherine J. Flynn knows how electronic medical records can overwhelm — and often change — the course of a medical liability lawsuit.

In one of her cases, a New Jersey doctor being sued for medical negligence has been accused by a plaintiff’s attorney of modifying a patient’s electronic history. A printing glitch caused the problem, Flynn said, but the accusation has meant extra time and defense costs. Computer screen shots were reviewed, more evidence was gathered and additional arguments were made.

“This has taken a life of its own, and we’ve done virtually no discovery on the medical aspects of the case,” she said. “The cost of the e-discovery alone is in excess of $50,000.”

System breaches. Modification allegations. E-discovery demands. These issues are becoming common courtroom themes as physicians transition from paper to EMRs, legal experts say. Not only are EMRs becoming part of medical negligence lawsuits, they are creating additional liability.

Across the country, the move from paper to electronically stored health data is growing. The 2009 federal stimulus package provided federal funds for the creation of a health information technology infrastructure. Health professionals can receive up to $44,000 for Medicare or nearly $64,000 for Medicaid by adopting electronic medical records.

Studies are mixed about how EMRs will impact liability for physicians. A 2010 survey by Conning Research and Consulting, an insurance industry research firm, found that most insurers believe medical claims will rise during the move from paper to electronic records. Lawsuits probably will decrease after an adjustment period, the study said. A report in the Nov. 18, 2010, issue of The New England Journal of Medicine said doctors should expect a varied landscape of liability risks and benefits as EMR adoption unfolds.

Whatever the future holds for EMRs, it’s important that doctors reduce their liability risks during system implementation, legal experts say. Being aware of potential legal pitfalls prevents doctors from falling victim to technology intended to do good — not cause hardship.

“It’s all about the system that’s in place and the integrity of that system,” Flynn said. “You can only do what the system allows you to do. If you have a good system in place, then the doctors are protected — even from themselves.”

NZ: ACC Breach Horrifies Abuse Victims

By Amelia Romanos
nzherald.co.nz
Originally published March 13, 2012

Sexual abuse victims have been thrown into a state of panic after reports that their private ACC (Accident Compensation Corporation) details might have been released.

An ACC file containing details of more than 9000 claimants was reportedly emailed to an unauthorised recipient last year.

The file is believed to contain about 250 sensitive claims cases, which deal with injuries resulting from sexual assault and sexual abuse.

One Auckland woman, who has a historic sensitive claim with ACC, said she was horrified by the possible breach.

"Things are put aside, and you're working through things and now it's all coming back,'' she told APNZ.

"You just want to get on with your life and this is shocking.''

Her claim related to an incident in 1993 involving her then father-in-law, and she was concerned any details being released now would cause problems at her daughter's wedding later this year.

"There are a lot of family members, including many who don't know, and the fallout from my name getting out could be huge,'' she said.

The whole story is here.

ACC Media Statement Regarding Privacy

13 March 2012

ACC deeply regrets this situation.

The facts are as follows.

On 1 August last year, one of our Auckland staff included amongst other information in an email to a client, a spreadsheet containing information pertaining to other clients. Details in the spreadsheet related to ACC claims that had been under review, and included client names, claim numbers and branches involved. There was no personal information in the spreadsheet.

In December, a client advised us that they were in possession of information not relevant to them.

ACC subsequently wrote to the client, requesting the information to be returned immediately.

I can now confirm that the information has been destroyed, and is no longer on the hard drive of the computer of the client who received it. Our next task is to contact each of the clients affected, to advise them of the breach and confirm that their information is now protected.

Clearly, we must review our internal processes to ensure this type of event doesn’t occur again. Can I reiterate ACC’s concern, and I’d like to apologise to all ACC clients.

Ralph Stewart
Chief Executive
Accident Compensation Corporation

Sunday, February 19, 2012

Data Breaches Put Patients at Risk for Identity Theft

By Robin Erb
Detroit Free Press
Originally published 2/12/12

Walk into a doctor's office and chances are that some of your most private information -- from your Social Security number to the details of your last cervical exam and your family's cancer history -- is stored electronically.

Your doctor might access the information on a cell phone that could slip into the wrong hands. The staff might take it home on a laptop or a flash drive.

As Detroit-area health care providers take multimillion-dollar steps toward electronic records, they're talking about more than efficiency and better care. They're talking security, too.

"It's a great concern," said Dr. Matthew Zimmie, who is heading an $80-million conversion to electronic records at Oakwood Healthcare System.

Oakwood's security measures include passwords and security profiles — allowing a radiology tech, for example, to look only at information for radiology patients.
"We definitely take this seriously," Zimmie said.

They have to. According to a recent report by the Ponemon Institute, a Traverse City, Mich.-based firm that conducts research about privacy and security:
  • Data breaches nationally grew 32% last year, mostly because of employee negligence and lack of oversight.
  • Nearly all of the 72 organizations surveyed reported at least one incident of lost or stolen information in the previous year.•And although four out of five doctors use smartphones, more than half say they are not taking precautions to encrypt information.
  • The top three causes for a data breach were lost or stolen computing devices, unintentional release of information by contractors and unintentional employee action, according to the report.
  • More than half of the respondents reported they had little or no confidence that their organization would be able to detect all breaches.
"It's almost a matter of time before anyone can be a victim. The key is catching it early," said Dennis Doherty, an assistant prosecutor who handles fraud cases for Wayne County, Mich.

Wednesday, February 15, 2012

Preventing a Data Breach and Protecting Health Records

Preventing a Data Breach and Protecting Health Records
Found in the public domain.