Data Breach Discovered by the Eye Institute of Corpus Christi
The Eye Institute of Corpus Christi, a full service eye care, diagnosis, and treatment clinic in Texas, has discovered that individuals gained access to the records of all of its patients, downloaded their protected health information from the EHR, copied those data, and provided them to two physicians formerly employed by the eye clinic.
The disclosed data include the names of patients, their addresses, contact telephone numbers, Social Security numbers, dates of birth, medical diagnoses, details of treatment, and health insurance details.
The Eye Institute became aware of the patient privacy breach on January 6, 2016., and has since discovered that data provided to the physicians have been used to contact patients in an attempt to solicit business. The physicians in question had been employed at The Eye Institute of Corpus Christi until recently.
The Eye Institute of Corpus Christi has been in touch with the physicians concerned and has instructed them to return the stolen data. It is not clear from the breach report whether the data have been returned and are now secured.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
While some patients have been contacted, the physicians have apparently not disclosed the data to any other individuals and appear to have only been using the client details to recruit patients to their new place of business.
The Eye Institute initiated an investigation into the data breach in January when the data theft was discovered. The matter has been reported to law enforcement and federal authorities have also been informed of the data breach. Additional protections have now been put in place to prevent future incidents such as this from occurring in the future and all user passwords and credentials have been changed.
It is not clear from the breach report whether the individuals who accessed, copied, and disclosed patient PHI to the physicians have been identified. The investigation into the privacy breach is ongoing.
