7,500 Patients Notified of Indian Health Service PHI Theft
The medical records of approximately 7,500 patients of an Indian Health Service medical center have been recovered from storage units in Waterflow in New Mexico, at least 5 months after they were stolen by a former employee.
Back in October, the records of 470 patients of the Northern Navajo Medical Center in Shiprock were found in a public storage facility by a community member. The matter was reported to the Navajo Area Indian Health Service on October 5, 2015, and staff were sent to recover the documents.
According to the IHS breach notice, the Department of Health and Human Services Office of Inspector General Investigator investigated the breach and discovered that files had been taken by a former employee. Some of the employee’s personal items were also located in the storage facility.
The investigation revealed that the data breach was much more extensive than initially thought. A further 7,000 documents were also recovered from storage facilities and have now been returned to the medical center. Now that the files have been recovered, patients are being notified of the breach of their protected health Information (PHI). The delay in issuing breach notification letters to patients was at the request of law enforcement while the investigation into the theft was being conducted.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The PHI contained in the files was highly sensitive and included the names of patients, their health insurance details, Social Security numbers, dates of birth, and medical diagnoses. Patients are now being provided with a year of credit monitoring and identity protection services via ID Experts, and will be protected with a $1,000,000 identity theft insurance policy.
Some months have passed since the files were taken, but Indian Health Service has not received any reports of data being used inappropriately.
To prevent similar data breaches from occurring in the future, Indian Health Service is conducting additional face to face training with staff members on document management responsibilities and further training is also being provided on laws covering the maintenance of government documents. Policies and procedures have also been updated to reduce the risk of further PHI breaches.
