HealthReach Community Health Centers Reports Improper Disposal Incident Affecting Almost 117,000 Patients
The protected health information (PHI) of 116,898 patients of Waterville, MA-based HealthReach Community Health Centers has been potentially compromised in a third-party data breach.
HealthReach Community Health Centers, which operates 11 community health centers in Central and Western Maine, discovered a worker at a third-party data storage facility had improperly disposed of hard drives that contained the data of patients.
Under HIPAA, all electronic devices that contain PHI must be disposed of in a manner that ensures data on the devices cannot be read or reconstructed. This typically involves clearing (using software or hardware products to overwrite media with non-sensitive data), purging (degaussing or exposing the media to a strong magnetic field), or destroying the media via disintegration, pulverization, melting, incineration, or shredding.
In a data breach notice sent to the Maine Attorney General, HealthReach said patient data had been exposed on April 7 and it was notified about the improper disposal incident on May 7. Upon discovery of the incident, HealthReach launched an investigation to determine what information was stored on the drives and which individuals had been affected.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The types of information on the stored drives varied from patient to patient and included patient names in addition to some or all of the following types of information: addresses, dates of birth, Social Security numbers, medical record numbers, health insurance information, lab test results, treatment records, and financial account information.
Notification letters were mailed to affected individuals on September 9, 2021. Individuals who had their Social Security number or financial information exposed have been offered complimentary identity theft protection and credit monitoring services for one year. At the time of issuing notification letters, HealthReach had not received any reports of attempted or actual misuse of patient data.
HealthReach said it is working with its data storage vendors to ensure similar breaches do not occur in the future, including providing further training for the workforce.
