HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Dominican Hospital Informs Patients of Accidental PHI Disclosure

Dignity Health’s Dominican Hospital in Santa Cruz, CA has announced that there has been an accidental disclosure of protected health information.

A spreadsheet containing a limited amount of PHI was sent to an associated health plan as was standard procedure. However, some of the patients whose PHI was disclosed were not members of the health plan. According to the substitute breach notice submitted to the California Attorney General’s office, the spreadsheet contained the data of an “excessive number of patients.” It is not clear at this stage how many patients have been affected by the incident.

Dominican Hospitals encrypts all patient data sent via email so there is no chance of information being intercepted. The privacy breach was discovered on July 28, 2016 and rapid action was taken to rectify the error. The hospital contacted the health plan and requested the spreadsheet be deleted. Dominican Hospital is currently waiting for attestation from the health plan that the data have been deleted.

The Health Plan is a HIPAA covered entity and is therefore aware of the rules covering patient privacy, so the risk of data being used inappropriately is believed to be low. Additionally, only limited patient data were disclosed.

Please see the HIPAA Journal Privacy Policy

Patients affected by the privacy breach have had the following data compromised: Name, account number, admission date, length of stay, room number, unit name, insurer’s name, and the total charges for the medical services received. Apart from the charges, no other financial data were disclosed and Social Security numbers were not detailed in the spreadsheet.

The spreadsheet also contained screenshots of the electronic health record system. Some patients have also had their age and date of birth disclosed, along with their gender, primary care provider name, attending physician’s name, reason for visit, and medical record number.

The privacy breach has prompted the hospital to re-educate staff members on the rules covering patient privacy and appropriate measures are being taken to reduce the risk of similar privacy breaches occurring in the future. The member of staff who made the error will also be subjected to appropriate disciplinary procedures.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.