HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

CHI Franciscan Health Alerts Patients to ePHI Exposure

CHI Franciscan Health has started notifying patients about the potential exposure of some of their electronic protected health information after a laptop computer was stolen from an employee.

According to The News Tribune, a CHI Franciscan Health employee had a backpack stolen on October 18. The backpack contained documents that included some patient health information, a work laptop computer, and a mobile phone.

The backpack also contained a day planner, in which the login credentials for the laptop were recorded. The information in the documents could potentially have been viewed and the login credentials could have been used to gain access to the electronic protected health information stored on the laptop.

CHI Franciscan Health has not received any reports to suggest any information has been accessed or used inappropriately, although patients have been informed to take precautions against identity theft. All affected individuals have been offered a year of credit monitoring services without charge.

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

The exposed ePHI/PHI includes the names, phone numbers, Social Security numbers, demographic information, and next of kin names of current and deceased patients.

Law enforcement was notified upon discovery of the theft, although laptop computer has not been recovered. The incident has yet to appear on the Department of Health and Human Service’ Office for Civil Rights Breach Portal so it is currently unknown how many individuals have been affected.

This is the third data security incident affecting CHI Franciscan Health this year. In early September, CHI Franciscan Health’s Highline Medical Center in Burien, WA reported a potential breach of 18,399 patient records after its network server. A vendor of Highline Medical Center, R-C Healthcare Management, removed security protections during a server upgrade and failed to reactivate them when work had been completed.

CHI Franciscan Health also reported a data security incident in September that affected St. Clare Hospital in Lakewood, WA and St. Joseph Medical Center in Tacoma, WA. That electronic medical record breach impacted 2,818 individuals.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.