Lane County Health and Human Services and New England Dermatology Alert Patients to PHI Exposure

The medical records of more than 17,000 patients have been exposed in two recent incidents in Oregon and Massachusetts.

Lane County Health and Human Services Alerts Patients to Loss of PHI

Lane County Health and Human Services in Oregon is notifying more than 700 patients that some of their protected health information has been lost and has potentially been destroyed.

49 boxes containing patient files were moved to a temporary storage facility while the Charnelton Clinic in Eugene was being renovated. During a routine search, the boxes of files were discovered to be missing from the storage facility on June 19.

Multiple teams conducted further searches for the missing boxes but they could not be located. Lane County Health and Human Services suspects the boxes of files have been destroyed along with other paperwork as part of its normal document management practice for non-medical records. However, it has not been possible to confirm whether that was definitely the case.

The files contained information such as patients’ full names, addresses, telephone numbers, medical histories and Social Security numbers. 566 files related to patients of Community Health Centers in Lane County, and 149 files were Lane County Developmental Disabilities client files.

Patients have been notified about the breach and an offer has been made to reimburse patients for 6 months’ membership of an accredited credit monitoring service. Lane County Health and Human Services has reviewed its record storage policies and procedures and has now obtained specialized, secure medical records storage services to ensure that similar breaches are prevented in the future.

16,154 Patients of New England Dermatology Informed of Possible Exposure of PHI

16,154 patients of New England Dermatology have been informed that some of their PHI may have been disposed of incorrectly.

Boxes of paper records were disposed of without the records first being rendered unreadable and undecipherable, as is required by HIPAA. Normally, paper records containing patients’ protected health information are shredded prior to disposal. In this case, New England Dermatology believes that the records were collected by its waste contractor before they were shredded.

New England Dermatology was not able to determine exactly what records were disposed of insecurely, so as a precaution, all patients who had visited its Northampton office between June 10, 2013 and May 23, 2018 have been notified about the potential exposure of their PHI.

The paperwork contained information such as names, mailing addresses, and health information recorded during visits to the office. Highly sensitive information such as bank account details, credit and debit card information, medical insurance details, and Social Security numbers were not exposed at any point.

New England Dermatology has since updated its waste disposal policies to prevent similar incidents from occurring in the future and further training has been provided to employees and its contractors.

Author: Steve Alder has many years of experience as a journalist, and comes from a background in market research. He is a specialist on legal and regulatory affairs, and has several years of experience writing about HIPAA. Steve holds a B.Sc. from the University of Liverpool.