HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Breach of Patient Data Reported by Barrington Orthopedic Specialists

Barrington Orthopedic Specialists, an Illinois-based healthcare provider, has reported it has suffered a breach of patient data after a laptop computer and an EMG machine were stolen from a vehicle while being transported between its facilities.

The equipment theft took place at some point between August 14 and August 18, 2015, and was discovered by Barrington Orthopedic Specialists (BAS) on August 18. Following the discovery of the theft, BAS informed law enforcement officers and an investigation was launched to determine the extent of the breach wand which patients had been affected. That investigation has now been concluded.

The data breach is understood to have affected 1,009 individuals and resulted in their names, dates of birth, and EMG test results and reports potentially being exposed to criminals. According to the breach notice issued by BAS, no Social Security numbers, financial data, insurance information or contact details were stored on the equipment.

The risk of identity theft and fraud faced by the victims is therefore believed to be particularly low. As such the company will not be offering credit monitoring services and identity fraud protection to the victims. Breach notification letters have now been sent to all concerned to alert them to the violation of their privacy and exposure of their PHI and PII. They have also been assured that additional data security measures are being put in place to prevent future data breaches from occurring.

Get The Checklist

Free and Immediate Download
HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

In this case the PHI and PII exposed as a result of the equipment theft was limited; however the transportation of unencrypted computer equipment used to store PHI and PHI does place patient data at risk. There have been a number of cases of theft reported to the Department of Health and Human Services’ Office for Civil Rights in recent months, many of which have resulted in sensitive data being exposed.

In an effort to address this risk, and to prevent further exposure of PHI and PII, Barrington Orthopedic Specialists have taken the decision to purchase additional equipment so that it will no longer be necessary to transport EMG machines (and their associated laptops) between medical centers. The laptop computers used by the healthcare provider will also no longer be used to store PHI/PHI, instead that information will now be maintained on the company’s internal computer network.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.