Harris County, TX: PHI of 26,000 Individuals Exposed Online

Harris County in Texas has discovered the personal and health information (PHI) of thousands of individuals has been exposed online and was potentially accessed by unauthorized individuals.

Under Harris County’s legally required reporting obligations, information is provided to the Harris County Justice Administration Department which includes System Person Numbers, which are unique identifiers that are assigned to individuals by the Harris County jail system. In addition to those numbers, some limited health information is provided related to the medical care individuals received at the County’s Jail Clinic, which includes health histories, diagnoses, and/or prescription information.

The inadvertent disclosure of sensitive information was discovered by Harris County officials on July 9, 2021. Harris County determined that between March 15, 2021 and May 22, 2021, the above types of information were inadvertently made available on the Justice Administration Department’s website.

No names were included, nor any Social Security numbers or financial account information, but since unique identifiers were included, it may have been possible for individuals to be identified.  During the course of the investigation, no evidence was found to indicate the exposed information was accessed or downloaded by unauthorized individuals and no reports have been received that suggest any information has been misused.

Harris County is encouraging all affected individuals to review any statements they receive from their healthcare providers and to check them carefully and report any instances where healthcare services are listed that they have not received.

The investigation is ongoing, and a helpline has been set up for affected individuals to receive further information (1-855-545-2039). Harris County is also taking steps to enhance existing processes to prevent similar breaches in the future.

The breach has been reported to the Department of Health and Human Services’ Office for Civil Rights as affecting 26,000 individuals.

Author: Steve Alder has many years of experience as a journalist, and comes from a background in market research. He is a specialist on legal and regulatory affairs, and has several years of experience writing about HIPAA. Steve holds a B.Sc. from the University of Liverpool.