Dominican Hospital Informs Patients of Accidental PHI Disclosure
Dignity Health’s Dominican Hospital in Santa Cruz, CA has announced that there has been an accidental disclosure of protected health information.
A spreadsheet containing a limited amount of PHI was sent to an associated health plan as was standard procedure. However, some of the patients whose PHI was disclosed were not members of the health plan. According to the substitute breach notice submitted to the California Attorney General’s office, the spreadsheet contained the data of an “excessive number of patients.” It is not clear at this stage how many patients have been affected by the incident.
Dominican Hospitals encrypts all patient data sent via email so there is no chance of information being intercepted. The privacy breach was discovered on July 28, 2016 and rapid action was taken to rectify the error. The hospital contacted the health plan and requested the spreadsheet be deleted. Dominican Hospital is currently waiting for attestation from the health plan that the data have been deleted.
The Health Plan is a HIPAA covered entity and is therefore aware of the rules covering patient privacy, so the risk of data being used inappropriately is believed to be low. Additionally, only limited patient data were disclosed.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Patients affected by the privacy breach have had the following data compromised: Name, account number, admission date, length of stay, room number, unit name, insurer’s name, and the total charges for the medical services received. Apart from the charges, no other financial data were disclosed and Social Security numbers were not detailed in the spreadsheet.
The spreadsheet also contained screenshots of the electronic health record system. Some patients have also had their age and date of birth disclosed, along with their gender, primary care provider name, attending physician’s name, reason for visit, and medical record number.
The privacy breach has prompted the hospital to re-educate staff members on the rules covering patient privacy and appropriate measures are being taken to reduce the risk of similar privacy breaches occurring in the future. The member of staff who made the error will also be subjected to appropriate disciplinary procedures.
