UAB Medicine Alerts 652 Patients of PHI Exposure
The UAB Medicine Viral Hepatitis Clinic in Birmingham, AL has experienced a breach of patients’ protected health information (PHI).
UAB Medicine uses flash drives to transfer data from its Fibroscan machine to a computer. On October 25, 2017, two flash drives were discovered to be missing. The portable storage devices contained a limited amount of PHI of 652 patients.
Information stored on the devices included first and last names, gender, birth dates, images and numbers relating to test results, medical diagnosis, names of referring physician, and the dates and times of the examination.
UAB Medicine has confirmed that no Social Security numbers, financial information, insurance details, addresses, or phone numbers were stored on the flash drives.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
An extensive search of Viral Hepatitis Clinic was conducted, but the flash drives could not be located. The investigation into the breach is continuing. It is not known whether the flash drives were accidentally disposed of, lost within the facility, or if they were stolen. UAB Medicine therefore cannot say whether the PHI on the devices has been viewed by unauthorized individuals.
The breach of PHI has prompted UAB Medicine to review its policies and procedures and measures have been implemented to prevent similar incidents from occurring in the future. All patients affected by the incident were notified of the breach by mail this week.
Due to the limited nature of data that was exposed, patients are not believed to face a high risk of identity theft and fraud. As a precaution, patients have been advised to monitor their credit reports for any sign of fraudulent activity.
Since the possibility of unauthorized access of PHI cannot be ruled out, UAB Medicine is also offering patients impacted by the incident 12 months of credit monitoring and reporting services without charge.
