New Mexico Department of Health Data Breach Affects 561 Individuals
A New Mexico Department of Health data breach report indicates 561 patients have had their Protected Health Information (PHI) exposed as a result of the theft of an unencrypted laptop computer from an employee’s vehicle.
The Department of Health employee does not appear to have been targeted, as a number of automobiles were broken into on the same day in the church parking lot where the vehicle was parked. The theft was reported to law enforcement officers, although the laptop computer has not been recovered.
An investigation was conducted to determine what data were stored on the laptop. Some of the information was password protected, although patient first and last names, dates of birth, medications, facility unit, and in some cases, medical diagnoses, were also stored on the laptop and could potentially be accessed by the thief. Affected patients had visited the New Mexico Behavioral Health Institute in Las Vegas between June 1997 and September 2013.
Some patients who visited Albuquerque’s Sequoyah Adolescent Treatment Center between 2013 and 2015 were also affected by the breach. All patients have now been notified of the laptop theft and data breach by mail, and have been offered a year of credit monitoring services without charge.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
New Mexico Department of Health Data Breach Announcement Delayed by 10 Weeks
The Health Insurance Portability and Accountability Act’s Breach Notification Rule requires all covered entities to notify the Department of Health and Human Services’ Office for Civil Rights of any breach of Protected Health Information. If more than 500 individuals have been affected, covered entities are allowed up to 60 days following the discovery of a data breach in order to submit the breach notice. A media announcement should also be issued at the same time, and all affected patients must be notified of the breach of their information within the same 60-day time frame.
The New Mexico Department of Health data breach notice place on the New Mexico Department of Health website is dated December 17, 2015. The breach notice submitted to the Office for Civil Rights is dated December 15, 2015, yet the theft occurred on October 4, 2015. It is not clear why the 60-day breach notification time frame was exceeded.
