1,000 Mental Health Patients’ PHI Accidentally Disclosed for 3 and a Half Years
1,071 patients who received medical services at the Des Moines Crisis Observation Center operated by Polk County Health Services Inc., have been informed that some of their protected health information has been “accidentally and unknowingly disseminated” over a period of three and a half years.
The breach was discovered on February 14, 2018, although the investigation revealed that information first started being disclosed on June 1, 2014 and continued until January 11, 2018. The types of information disclosed includes patients’ names along with Social Security numbers, home addresses, Medicaid ID numbers, admission dates, and discharge locations.
Through the Crisis Observation Center, Polk County Health Services provides mental health services for residents of Polk County, IA and is the regional administrator and governing board for mental health and disability services for the county.
Polk County Health Services is aware of the individual(s) to whom the information has been disclosed and was able to determine exactly the types of information that has been received by those individuals. The reason for the impermissible disclosure of protected health information and how PHI happened to be disclosed was not explained in the substitute breach notice uploaded to the Polk County Health Service website.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Steps have been taken to prevent any further disclosures of personal information or protected health information, and also to prevent any further dissemination of the information. The steps taken include providing further training to staff on the importance of protecting the privacy of patients and the implementation of additional computer security protections and protocols to prevent the unauthorized accessing and disclosure of PHI.
No reports have been received to suggest any patient’s PHI has been misused; however, as a precaution, all individuals affected by the breach have been offered complimentary credit monitoring services for 12 months. Notifications were mailed to affected individuals in April and the incident has been reported to the Department of Health and Human Services’ Office for Civil Rights.
