Potential 2,000 Record PHI Breach Reported by California Physician
Brian D. Halevie-Goldman M.D. has notified 2,000 patients that some of their protected health information has been exposed – and potentially accessed – by unauthorized individuals.
The data – which includes patient names, chart notes, and birthdates – were stored on two laptop computers which had been left in a locked vehicle. The laptop computers were protected with passwords, but were not encrypted. No highly sensitive information such as insurance information, Social Security numbers, or financial data were stored on the laptops.
The theft occurred on July 19, 2016 and the incident was immediately reported to the Vacaville California Police Department, although the devices have not been recovered. It is probable that the laptops were stolen for their value, rather than with the intention of accessing and using data stored on the devices, although that possibility cannot be ruled out. However, Dr. Halevie-Goldman believes that the risk of patient information being used inappropriately is limited.
Staff at Dr. Halevie-Goldman’s medical office are in the process of conducting a thorough review all data that are stored on the devices and further information will be provided to patients if any more information comes to light.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The Breach Notification Rule of the Health Insurance Portability and Accountability Act requires covered entities to issue a breach report to the Department of Health and Human Services’ Office for Civil Rights (OCR) promptly, and patients should be notified of any breach of PHI without unnecessary delay. However, covered entities are allowed up to 60 days from the discovery of a PHI breach to issue notifications and notify OCR. Many covered entities delay the issuing of notification letters to patients until close to the HIPAA deadline.
However, Dr. Halevie-Goldman’s office acted promptly. OCR was informed of the incident the day after the theft was discovered and breach notification letters were prepared for mailing two days later.
