HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Edwin Shaw Rehabilitation Hospital Patients’ PHI Exposed

Akron General Health System is notifying 975 patients of the Akron General Edwin Shaw Rehabilitation hospital that some of their protected health information has been exposed after an employee lost an unencrypted flash drive.

The flash drive contained “generic” data on patients that had visited the hospital for treatment between 2010 and 2011. No Social Security numbers, financial information, dates of birth, addresses, or phone numbers were exposed. Patients therefore face a low risk of the information being used inappropriately, should the device have been recovered by a third party. Data stored on the device include patient names, medical record numbers, treatment provided, name of the insurance carrier, and referring provider.

The flash drive was believed to have been lost on February 19, 2015. An Edwin Shaw employee who worked at the Cuyahoga Falls rehab center had taken the portable storage device off-site while attending a business meeting. The employee discovered the drive to be missing five days later.

The loss was reported to the hospital and an investigation was launched, although the device has not been recovered. The employee believed the flash drive must have been left in a “zippered day planner” which had been left behind at the location where the meeting took place.

Please see the HIPAA Journal Privacy Policy

Stephanie York, Akron General Health System director of communications and public relations, released a statement apologizing for the incident. York said it took some time to identify the patients affected and to locate them. A number had changed address over the five or six years since the data were recorded.

York confirmed that the member of staff responsible for the privacy breach has been disciplined over the incident and action has been taken to prevent similar incidents from occurring in the future. Members of staff at Akron General will also receive additional training on HIPAA rules regarding the protection of PHI.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.