HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

ePHI Improperly Accessed, Copied, and Lost by Employee

The protected health information of 600 individuals who received treatment for mental health disorders and/or substance abuse at a Baltimore treatment center has been compromised.

On November 28, 2016, Complete Wellness discovered that highly confidential information had been accessed and copied onto a flash drive without authorization. Even though the treatment center was able to identify the individual responsible, it was not possible to recover the drive as the device was allegedly lost by the employee.

While no reports of misuse of the information contained on the device have been received by Complete Wellness, the possibility remains that the drive has been found and patient data accessed.

Data stored on the device included patients’ names, phone numbers. home addresses, email addresses, ages and dates of birth, languages spoken, ethnicity, race, marital statuses, the names of primary care physicians, emergency contact information, level of education, employer information, hurricane victim status, living situation, arrest history, military service information, and whether individuals had any hearing or vision difficulties. Social Security numbers of patients were also downloaded to the device. Patients affected by the breach had previously received treatment from Leslie Duff CRNP or Durwood Whitten, PhD.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

Complete Wellness has since implemented a number of security measure to prevent future privacy breaches from occurring. Those measures included adopting technology to enable sensitive data to be sent securely rather than being transported on portable devices. Encryption technology has been implemented and additional privacy training provided to all administration and clinical staff members. A review of policies and procedures has been conducted and updates made to prevent similar incidents from occurring in the future.

Ongoing discussions have taken place with company leadership to address the security incident and prevent a recurrence. Complete Wellness has also confirmed that the employee was terminated as a result of the incident.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.