HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Decatur Health Systems Inform 707 Patients of Potential PHI Theft

Oberlin, KS-based Decatur Health Systems (DHS) has started notifying 707 patients about the potential theft of a limited amount of their protected health information.

The PHI was recorded in a binder that was being used by a radiology technician to monitor X-ray doses. The log binder was used to record patient details prior to them receiving CAT scans. No Social Security numbers were recorded, although the binder contained names, dates of birth, the reason for performing CAT scans, test dates, X-ray doses, and the names of referring physicians.

On July 25, 2016, the binder was discovered to be missing. A thorough search of the facility was organized to locate the binder but it could not be found. DHS believes the binder has been stolen.

The binder was kept in an area of the hospital which was not open to the general public. The doors to the facility were locked, although one of the doors had not been latched. It would have been possible for the door to be pushed open and access to the facility to be gained. The theft is believed to have occurred between 5pm on July 24 and 7am on July 25.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

The theft was reported to local law enforcement and the Federal Bureau of Investigation and advice was sought on how the information could be used, and therefore the level of risk faced by patients. Since health insurance information, Social Security numbers, financial information, and personal information of patients was not detailed in the binder, the risk to patients is deemed to be low.

The log was kept to satisfy hospital requirements for keeping a record of X-ray doses for each patient. The hospital has reviewed its policies and procedures and will now use a more secure method of recording the necessary information in the future.

Patient names will be replaced by codes which will ensure that individuals cannot be identified in the event that CAT scan logs are viewed by unauthorized individuals. While it is unlikely that a key to the locked facility has been obtained by an unauthorized individual, the hospital has replaced locks to the facility as a precaution. Staff members have also received further training on data security.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.