Nursing Home Residents’ PHI Accidentally Disclosed by Iowa DHS
Protected health information of 425 nursing home patients has been accidentally mailed to 12 nursing home facilities by the Iowa Department of Human Services.
The HIPAA breach occurred in December 2015, although it was not discovered by Iowa DHS until January 22, 2016. Last month, all affected patients were sent a breach notification letter alerting them to the accidental disclosure of their data. According to Iowa DHS, it is unlikely that any patient data have been used inappropriately as they were sent to another HIPAA covered entity.
The privacy breach occurred when Iowa DHS’ Medicaid Enterprise Medical Services department sent roster reports to the nursing homes. Those reports contained the names, Medicaid identification numbers, insurance or government program information, and the facility where each patient currently resides.
Upon discovery of the breach, Iowa DHS contacted all 12 nursing facilities and instructed them to shred the data they had received. All facilities have now confirmed that the data have been securely destroyed.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Medicaid Director Mikki Stier issued a statement apologizing to all affected individuals for the privacy breach and confirmed that the HIPAA breach was reported to the Department of Health and Human Services’ Office for Civil Rights in February. Patients affected by the incident have been advised of the methods they can use to reduce the risk of harm or loss, should they be worried about their data being misused.
McCoy pointed out that the privacy breach was totally unrelated to Gov. Terry Branstad’s controversial cost-saving plan to privatize the management of Iowa’s Medicaid program.
The latest patient privacy incident is one of around 100 HIPAA breaches recorded by the department in the past 12 months. In the majority of cases, only a small number of patients were affected. Iowa DHS spokeswoman, Amy McCoy, said “Most of those breaches involved individuals and were not as widespread as the nursing homes incident.”
