HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

1,000 Mental Health Patients’ PHI Accidentally Disclosed for 3 and a Half Years

1,071 patients who received medical services at the Des Moines Crisis Observation Center operated by Polk County Health Services Inc., have been informed that some of their protected health information has been “accidentally and unknowingly disseminated” over a period of three and a half years.

The breach was discovered on February 14, 2018, although the investigation revealed that information first started being disclosed on June 1, 2014 and continued until January 11, 2018. The types of information disclosed includes patients’ names along with Social Security numbers, home addresses, Medicaid ID numbers, admission dates, and discharge locations.

Through the Crisis Observation Center, Polk County Health Services provides mental health services for residents of Polk County, IA and is the regional administrator and governing board for mental health and disability services for the county.

Polk County Health Services is aware of the individual(s) to whom the information has been disclosed and was able to determine exactly the types of information that has been received by those individuals. The reason for the impermissible disclosure of protected health information and how PHI happened to be disclosed was not explained in the substitute breach notice uploaded to the Polk County Health Service website.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

Steps have been taken to prevent any further disclosures of personal information or protected health information, and also to prevent any further dissemination of the information. The steps taken include providing further training to staff on the importance of protecting the privacy of patients and the implementation of additional computer security protections and protocols to prevent the unauthorized accessing and disclosure of PHI.

No reports have been received to suggest any patient’s PHI has been misused; however, as a precaution, all individuals affected by the breach have been offered complimentary credit monitoring services for 12 months. Notifications were mailed to affected individuals in April and the incident has been reported to the Department of Health and Human Services’ Office for Civil Rights.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.