Orleans Medical Clinic Notifies 6,890 Patients of PHI Breach
Orleans Medical Clinic in Indiana is notifying all current and former patients that their protected health information has potentially been accessed by an unauthorized individual.
On or around April 17, 2016, the clinic noticed suspicious activity on a server used to store patients’ PHI. Immediate action was taken to secure the server and prevent data access. An investigation was also launched to determine whether patient data had been viewed or copied by the attacker.
The investigation revealed that an external third party first gained access to the server on April 5, 2016 and access continued for a period of almost two weeks. Orleans Medical Clinic had conducted a server upgrade; however, after the work was completed the server was accidentally left unprotected. No evidence was uncovered to suggest that PHI was viewed or obtained by the hacker, but it was not possible to rule out the possibility that PHI was compromised.
The server was used to store the electronic medical records of patients. While no financial information was stored on the server, patients have potentially had their name, address, contact information, demographic data, date of birth, medical history, and Social Security number compromised.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
It is not clear why it took so long to notify patients of the breach. Improper PHI access was first discovered on April 17, but it took almost four months to send breach notification letters to patients. According to the substitute breach notice that was uploaded to the company’s website in the past few days, confirmation of the individuals affected by the breach was not received by the Clinic until July 21, 2016.
All current and former patients of the clinic have been offered complimentary identity theft protection services with Equifax Personal Solutions for a period of 12 months.
The incident has been reported to the Department of Health and Human Services’ Office for Civil Rights and an investigation has been initiated. The FBI and the Indiana Attorney General’s Office have also been informed of the security breach and each is conducting its own investigation. According to the OCR breach report, 6,890 patients have been affected.
