Edwin Shaw Rehabilitation Hospital Patients’ PHI Exposed
Akron General Health System is notifying 975 patients of the Akron General Edwin Shaw Rehabilitation hospital that some of their protected health information has been exposed after an employee lost an unencrypted flash drive.
The flash drive contained “generic” data on patients that had visited the hospital for treatment between 2010 and 2011. No Social Security numbers, financial information, dates of birth, addresses, or phone numbers were exposed. Patients therefore face a low risk of the information being used inappropriately, should the device have been recovered by a third party. Data stored on the device include patient names, medical record numbers, treatment provided, name of the insurance carrier, and referring provider.
The flash drive was believed to have been lost on February 19, 2015. An Edwin Shaw employee who worked at the Cuyahoga Falls rehab center had taken the portable storage device off-site while attending a business meeting. The employee discovered the drive to be missing five days later.
The loss was reported to the hospital and an investigation was launched, although the device has not been recovered. The employee believed the flash drive must have been left in a “zippered day planner” which had been left behind at the location where the meeting took place.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Stephanie York, Akron General Health System director of communications and public relations, released a statement apologizing for the incident. York said it took some time to identify the patients affected and to locate them. A number had changed address over the five or six years since the data were recorded.
York confirmed that the member of staff responsible for the privacy breach has been disciplined over the incident and action has been taken to prevent similar incidents from occurring in the future. Members of staff at Akron General will also receive additional training on HIPAA rules regarding the protection of PHI.
