HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Austin Medical Center Discovers Patient Data Was Accessible Via Internet

An Austin, TX medical center has discovered patient data has been stolen and uploaded to the Internet and was accessible for 4 years. The information, which related to approximately 2,000 patients, could freely be found via search engines.

Victory Medical Center was alerted to the data leak on April 5, 2017 by a patient who had found his or her personal information online while browsing the Internet.

An investigation was launched by Victory Medical which revealed a paper based report containing patient information had been uploaded to Github by an unauthorized individual. The data was taken and uploaded without the knowledge or authorization by Victory Medical. The company says the breach was likely the work of a ‘lone bad actor’.

The date of the breach is not known, although it is likely the incident occurred on or after June 10, 2013 according to the substitute breach notice uploaded to the Victory Medical website. The report had been generated from Victory Medical’s secure patient record system, although it did not include any medical information.

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

The types of information exposed and likely viewed by unauthorized individuals was restricted to patients’ names, phone numbers, addresses, email addresses, preferred language, race and ethnicity and internal medical account numbers. Victory Medical contacted Github and arranged for the information to be removed. The information was taken offline five days later.

Since only demographic information has been exposed, Victory Medical believes the risk of improper use of the information is low.

The breach investigation involved interviews with all members of staff who were working at or around the time of the suspected breach, although the person responsible for the breach could not be identified.

The breach has prompted a review of privacy practices, policies and security procedures that could potentially have contributed to the breach, although no systemic weaknesses have been identified. Physical security standards are also being reviewed at the organization’s offices and feasible changes will be implemented to improve security and prevent future breaches of PHI.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.