ePHI Improperly Accessed, Copied, and Lost by Employee
The protected health information of 600 individuals who received treatment for mental health disorders and/or substance abuse at a Baltimore treatment center has been compromised.
On November 28, 2016, Complete Wellness discovered that highly confidential information had been accessed and copied onto a flash drive without authorization. Even though the treatment center was able to identify the individual responsible, it was not possible to recover the drive as the device was allegedly lost by the employee.
While no reports of misuse of the information contained on the device have been received by Complete Wellness, the possibility remains that the drive has been found and patient data accessed.
Data stored on the device included patients’ names, phone numbers. home addresses, email addresses, ages and dates of birth, languages spoken, ethnicity, race, marital statuses, the names of primary care physicians, emergency contact information, level of education, employer information, hurricane victim status, living situation, arrest history, military service information, and whether individuals had any hearing or vision difficulties. Social Security numbers of patients were also downloaded to the device. Patients affected by the breach had previously received treatment from Leslie Duff CRNP or Durwood Whitten, PhD.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Complete Wellness has since implemented a number of security measure to prevent future privacy breaches from occurring. Those measures included adopting technology to enable sensitive data to be sent securely rather than being transported on portable devices. Encryption technology has been implemented and additional privacy training provided to all administration and clinical staff members. A review of policies and procedures has been conducted and updates made to prevent similar incidents from occurring in the future.
Ongoing discussions have taken place with company leadership to address the security incident and prevent a recurrence. Complete Wellness has also confirmed that the employee was terminated as a result of the incident.
