Dedicated to providing the latest
HIPAA compliance news

7,500 Patients Notified of Indian Health Service PHI Theft

Share this article on:

The medical records of approximately 7,500 patients of an Indian Health Service medical center have been recovered from storage units in Waterflow in New Mexico, at least 5 months after they were stolen by a former employee.

Back in October, the records of 470 patients of the Northern Navajo Medical Center in Shiprock were found in a public storage facility by a community member. The matter was reported to the Navajo Area Indian Health Service on October 5, 2015, and staff were sent to recover the documents.

According to the IHS breach notice, the Department of Health and Human Services Office of Inspector General Investigator investigated the breach and discovered that files had been taken by a former employee. Some of the employee’s personal items were also located in the storage facility.

The investigation revealed that the data breach was much more extensive than initially thought. A further 7,000 documents were also recovered from storage facilities and have now been returned to the medical center. Now that the files have been recovered, patients are being notified of the breach of their protected health Information (PHI). The delay in issuing breach notification letters to patients was at the request of law enforcement while the investigation into the theft was being conducted.

The PHI contained in the files was highly sensitive and included the names of patients, their health insurance details, Social Security numbers, dates of birth, and medical diagnoses. Patients are now being provided with a year of credit monitoring and identity protection services via ID Experts, and will be protected with a $1,000,000 identity theft insurance policy.

Some months have passed since the files were taken, but Indian Health Service has not received any reports of data being used inappropriately.

To prevent similar data breaches from occurring in the future, Indian Health Service is conducting additional face to face training with staff members on document management responsibilities and further training is also being provided on laws covering the maintenance of government documents. Policies and procedures have also been updated to reduce the risk of further PHI breaches.

Author: HIPAA Journal

HIPAA Journal provides the most comprehensive coverage of HIPAA news anywhere online, in addition to independent advice about HIPAA compliance and the best practices to adopt to avoid data breaches, HIPAA violations and regulatory fines.

Share This Post On