California Dept. of Developmental Services Notifies 582,000 Patients of Potential PHI Compromise
The California Department of Developmental Services (DDS) is notifying 582,174 patients that their protected health information has potentially been compromised.
On February 11, 2018, thieves broke into the DDS legal and audits offices in Sacramento, CA. During the time the thieves were in the offices they potentially had access to the sensitive information of approximately 15,000 employees, contractors, job applicants, and parents of minors who receive DDS services, in addition to the PHI of more than half a million patients. The thieves also stole 12 government computers.
It does not appear that the perpetrators were interested in paper records and all computers taken by the thieves were encrypted so data access was not possible. DDS has confirmed that none of the office computers were used to gain access to the department’s network and electronic protected health information remained secure at all times.
In its substitute breach notice, DDS explained that its offices were vandalized and a fire was started, which triggered the sprinkler system causing damage to documents and CDs.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The nature of the vandalism and the damage caused by the fire and sprinkler system has made it impossible to determine with 100% certainty whether any information was taken from the offices or if PHI has been compromised.
If PHI was viewed or stolen it would have been limited to names, medical records, unique state-issued client identifier numbers, service codes, service dates, units billed, and amounts paid for services.
The incident has been reported to law enforcement and the burglary has been investigated but the perpetrators have not been identified.
While it is unlikely that the thieves gained access to the protected health information of patients, notifications have been sent to affected individuals out of an abundance of caution and the incident has been reported to the Department of Health and Human Services’ Office for Civil Rights.
The security breach is the largest to be reported to OCR in 2018, eclipsing the 279,865 -record breach at Oklahoma State University Center for Health Sciences that was reported in January and the 134,512-record breach at St. Peter’s Surgery & Endoscopy Center, reported in February.
