HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Arizona Department of Health Services Notifies 2,500 Patients of Potential Loss of PHI

Data collected as part of a newborn screening program run by the Arizona Department of Health Services (ADHS) has been lost in the mail. The information, which was to be used for billing purposes, contained the personal information, financial data and sensitive health information of approximately 2,500 patients.

Names, addresses, phone numbers, Social Security numbers, health insurance information, birth dates, and health information relating to mothers and newborns have all potentially been exposed. While state officials have said no evidence has been found to suggest any of the information has been accessed by unauthorized individuals or misused, ADHS has no idea where the records are located.

The information was sent via the U.S. Postal Service to billing contractor Midwest Medical Practice Management of Carbondale, Illinois in two boxes; however, only one of the boxes arrived.

The last known location of the missing box was a Postal Service facility in Phoenix, AZ. The U.S. Postal Services has been contacted and a search for the missing box has been conducted. Postal Service records indicate the parcel was not delivered to an alternate address and did not leave the Phoenix facility. The box was last tracked on April 22, 2017.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

The search for the missing box is continuing, although ADHS is assuming the records may not be found with all affected individuals already notified that their PHI may have been exposed. No identity theft protection services are being offered to affected individuals at this stage as no evidence has been uncovered to suggest the records have been accessed by unauthorized individuals. That may change if the package is not located and declared lost.

The incident has prompted ADHS to conduct a review of its policies and procedures for transferring patient information, including the possibility of using a secure web-based system for transferring billing information rather than mailing physical records.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.