Arizona Department of Health Services Notifies 2,500 Patients of Potential Loss of PHI
Data collected as part of a newborn screening program run by the Arizona Department of Health Services (ADHS) has been lost in the mail. The information, which was to be used for billing purposes, contained the personal information, financial data and sensitive health information of approximately 2,500 patients.
Names, addresses, phone numbers, Social Security numbers, health insurance information, birth dates, and health information relating to mothers and newborns have all potentially been exposed. While state officials have said no evidence has been found to suggest any of the information has been accessed by unauthorized individuals or misused, ADHS has no idea where the records are located.
The information was sent via the U.S. Postal Service to billing contractor Midwest Medical Practice Management of Carbondale, Illinois in two boxes; however, only one of the boxes arrived.
The last known location of the missing box was a Postal Service facility in Phoenix, AZ. The U.S. Postal Services has been contacted and a search for the missing box has been conducted. Postal Service records indicate the parcel was not delivered to an alternate address and did not leave the Phoenix facility. The box was last tracked on April 22, 2017.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The search for the missing box is continuing, although ADHS is assuming the records may not be found with all affected individuals already notified that their PHI may have been exposed. No identity theft protection services are being offered to affected individuals at this stage as no evidence has been uncovered to suggest the records have been accessed by unauthorized individuals. That may change if the package is not located and declared lost.
The incident has prompted ADHS to conduct a review of its policies and procedures for transferring patient information, including the possibility of using a secure web-based system for transferring billing information rather than mailing physical records.
