HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

9,350 Patients of Gordon Schanzlin New Vision Institute Notified of Data Breach

The Gordon Schanzlin New Vision Institute in La Jolla, CA, is alerting thousands of patients that their medical records may have been stolen after files containing protected health information were discovered in the possession of an individual unauthorized to hold the information.

The data breach came to light following an investigation conducted by the U.S. Postal Inspection Service. A raid was conducted on a property in Southern California and a box of medical records was discovered in the property.

The files contained information such as names, dates of service, addresses, health insurance information, Social Security numbers, and health and clinical information.

Gordon Schanzlin was notified of the discovery on June 15, 2018, and an internal investigation was immediately launched to determine the nature and scope of the breach and how the medical records had been stolen.

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

While it could not be confirmed with 100% certainty, Gordon Schanzlin believes the medical records were part of a batch of files that were stolen from a storage unit that was broken into in October 2017.

The boxes in the storage unit contained the medical records of 9,351 patients. While only a small number of files were recovered following the raid, Gordon Schanzlin took the decision to notify all 9,351 patients about the discovery out of an abundance of caution.

Due to the sensitive nature of data in the files, and the potential for the information to be used for identity theft and fraud, Gordon Schanzlin is offering all patients potentially affected by the breach one year of credit monitoring services through Experian. Those services are provided at no cost to patients. Breach notification letters were mailed on August 14, 2018.

In response to the breach, staff have received additional training and additional safeguards are being implemented to better protect all stored protected health information.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.