HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Lost Flash Drive Exposes Data of Karmanos Cancer Center Patients

An unencrypted flash drive containing the protected health information of 2,808 patients of the Barbara Ann Karmanos Cancer Center has been declared lost. The flash drive had been mailed to Barbara Ann Karmanos Cancer Center but when the package arrived, the flash drive was discovered to be missing.

The portable storage device was placed in an envelope and was mailed, which was the last time the device was seen. The hospital has reported that efforts are being made to try to locate the flash drive although the device appears to have been lost in the mail.

The flash drive was used to store data as part of a system upgrade. An investigation into the potential privacy breach was launched when the device was discovered to be missing to determine which patients had been affected, and the nature of the data stored on the device.

The portable storage device was found to only contain a limited amount of administrative data which included the names of patients, their treating physicians, the name of the hospital where treatment was provided, and unique patient identifiers. No financial information, credit card numbers, dates of birth, Social Security numbers, or other highly sensitive data were stored on the device. Affected patients had received medical services at the healthcare provider’s Detroit or Farmington Hills facilities.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

According to a statement issued by a hospital spokesperson, patients are only believed to face “minimal risk”. No evidence has been uncovered to suggest that any data have been used inappropriately. However, because there is a risk that the data could be viewed by an unauthorized individual, all affected patients have been offered a year of credit monitoring services without charge. Breach notification letters were sent to all affected patients to advise them of the potential exposure of their data. The letters were mailed on March 10, 2015.

“Additional steps” have been taken by Barbara Ann Karmanos Cancer Center to prevent similar breaches from occurring in the future.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.