Decatur Health Systems Inform 707 Patients of Potential PHI Theft
Oberlin, KS-based Decatur Health Systems (DHS) has started notifying 707 patients about the potential theft of a limited amount of their protected health information.
The PHI was recorded in a binder that was being used by a radiology technician to monitor X-ray doses. The log binder was used to record patient details prior to them receiving CAT scans. No Social Security numbers were recorded, although the binder contained names, dates of birth, the reason for performing CAT scans, test dates, X-ray doses, and the names of referring physicians.
On July 25, 2016, the binder was discovered to be missing. A thorough search of the facility was organized to locate the binder but it could not be found. DHS believes the binder has been stolen.
The binder was kept in an area of the hospital which was not open to the general public. The doors to the facility were locked, although one of the doors had not been latched. It would have been possible for the door to be pushed open and access to the facility to be gained. The theft is believed to have occurred between 5pm on July 24 and 7am on July 25.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The theft was reported to local law enforcement and the Federal Bureau of Investigation and advice was sought on how the information could be used, and therefore the level of risk faced by patients. Since health insurance information, Social Security numbers, financial information, and personal information of patients was not detailed in the binder, the risk to patients is deemed to be low.
The log was kept to satisfy hospital requirements for keeping a record of X-ray doses for each patient. The hospital has reviewed its policies and procedures and will now use a more secure method of recording the necessary information in the future.
Patient names will be replaced by codes which will ensure that individuals cannot be identified in the event that CAT scan logs are viewed by unauthorized individuals. While it is unlikely that a key to the locked facility has been obtained by an unauthorized individual, the hospital has replaced locks to the facility as a precaution. Staff members have also received further training on data security.
