Integrated Rehab Consultants Takes 16 Months to Notify Patients of PHI Breach
The Chicago, IL-based physiatry group Integrated Rehab Consultants is sending notification letters to certain patients alerting them to the exposure of some of their protected health information, as is required by HIPAA. However, the breach was not discovered in the past 60 days. Integrated Rehab Consultants (IRC) first became aware of the exposure of PHI on December 2, 2016 – 16 months ago.
The data – which included patients’ full names, address, date of birth, gender, medical provider information, visit date, visit status, admission date, appointment visit ID, treatment location, procedure code, and diagnosis codes – had been uploaded to a publicly accessible repository. The PHI was discovered by a healthcare security researcher who notified IRC about the breach.
Prompt action was taken to remove and secure the data and an investigation was launched to determine how and why the data had been uploaded to an insecure location. That investigation determined that a business associate who had been provided with the PHI had disclosed the information to a third party. It was that subcontractor that made the error and uploaded the data to the public repository.
At the time, IRC only believed the data had been accessed by the security researcher. However, in its substitute breach notice, IRC explained that in the fall of 2017 it became apparent that other individuals may also have gained access to the data.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Patients potentially impacted have been offered complimentary credit monitoring and identity restoration services for 12 months without charge and notified about the incident ‘out of an abundance of caution.’ ICR has not received any reports to suggest any patient information has been misused, although affected individuals have been urged to check their credit reports and EoB statements carefully and to remain vigilant against incidents of identity theft and fraud.
Patients may not have been notified of the exposure of their PHI within 60 days of the initial discovery as it may not have been believed there was a significant risk of financial loss or harm, although it is unclear why there was a delay in issuing notifications when it was suspected that other individuals may have gained access to the data.
