Chesapeake Regional Healthcare Reports PHI of 2,100 Patients Was Stored on Lost Hard Drives
Body:
Chesapeake Regional Healthcare has discovered two hard drives containing the protected health information (PHI) of approximately 2,100 patients are missing from the Chesapeake Regional Medical Center campus in Chesapeake, Virginia.
The data stored on the devices relates to individuals who took part in studies at its Sleep Center between April 2015 and February 2018.
It is currently unclear exactly when the hard drives went missing. Chesapeake Regional Healthcare discovered the devices were missing on February 6, 2018. An internal investigation was launched, and a full search of the facility was conducted, but the devices could not be located. The missing hard drives have been reported as lost/stolen to law enforcement, but Chesapeake Regional Healthcare said the probability of the devices being recovered is low and it does not expect the devices to be found.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The hard drives were not encrypted. If obtained by a third party, the protected health information of patients could potentially be accessed. The types of information stored on the devices includes names, demographic information, birth dates, unique patient identifiers, details of the procedures and tests performed at the Sleep Center, and information on medications that were prescribed. Social Security numbers, addresses, insurance information, and financial data were not stored on the device.
Chesapeake Regional Healthcare is taking steps to ensure similar breaches do not occur in the future. Those steps include improving policies related to the security of PHI stored on portable electronic devices. It is not clear whether the new measures will include data encryption.
Chesapeake Regional Healthcare is currently in the process of sending notifications to patients, who are being offered 12 months of complimentary credit monitoring and identity theft protection services. In the event that patients discover their health information has been used inappropriately, assistance will be offered to help mitigate any harm caused.
