HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Children’s Mercy Hospital Announces Breach of Children’s PHI

Children’s Mercy Hospital in Kansas City, MO has announced that 238 children’s medical records have been stolen from a vehicle used by a hospital employee.

The vehicle was locked and the records were stored in a hard-sided case, which was also locked. However, it is probable that the thieves managed to open the case and view the contents.

The theft occurred on August 4, 2016 and the incident was immediately reported to local law enforcement. It took a number of days for the hospital to determine the exact contents of the case and to verify which patients had been affected. Patients were notified of the incident 26 days later, well within the time limit required by the Health Insurance Portability and Accountability Act (HIPAA).

The data obtained by the thieves was limited in nature and did not include the types of information typically used for identity theft and fraud. No financial data, insurance information, or Social Security numbers were exposed.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

However, the families impacted by the breach have been urged to “take reasonable precautions” against identity theft and fraud. They have been told that entities or individuals may attempt to contact them to find out more information about their children, such a Social Security number.

Patients affected by the breach were told their name, phone number, date of birth, medical record, and account number were obtained by the thieves. Details of medical diagnoses were also detailed in the documents.

All affected families have been offered identity theft protection services for a period of one year without charge. Children’s Mercy Hospital is also taking all practical steps to resolve the situation and prevent future incidents of this nature from occurring.

Children’s Mercy Hospital is aware of the harm that can be caused by breaches of PHI and has issued an apology to the families affected by the breach.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.