Lost Flash Drive Exposes Data of Karmanos Cancer Center Patients
An unencrypted flash drive containing the protected health information of 2,808 patients of the Barbara Ann Karmanos Cancer Center has been declared lost. The flash drive had been mailed to Barbara Ann Karmanos Cancer Center but when the package arrived, the flash drive was discovered to be missing.
The portable storage device was placed in an envelope and was mailed, which was the last time the device was seen. The hospital has reported that efforts are being made to try to locate the flash drive although the device appears to have been lost in the mail.
The flash drive was used to store data as part of a system upgrade. An investigation into the potential privacy breach was launched when the device was discovered to be missing to determine which patients had been affected, and the nature of the data stored on the device.
The portable storage device was found to only contain a limited amount of administrative data which included the names of patients, their treating physicians, the name of the hospital where treatment was provided, and unique patient identifiers. No financial information, credit card numbers, dates of birth, Social Security numbers, or other highly sensitive data were stored on the device. Affected patients had received medical services at the healthcare provider’s Detroit or Farmington Hills facilities.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
According to a statement issued by a hospital spokesperson, patients are only believed to face “minimal risk”. No evidence has been uncovered to suggest that any data have been used inappropriately. However, because there is a risk that the data could be viewed by an unauthorized individual, all affected patients have been offered a year of credit monitoring services without charge. Breach notification letters were sent to all affected patients to advise them of the potential exposure of their data. The letters were mailed on March 10, 2015.
“Additional steps” have been taken by Barbara Ann Karmanos Cancer Center to prevent similar breaches from occurring in the future.
