Mental Health Counseling Records Stolen in Office Burglary

The Fox River Counseling Center on Bay Shore Drive, Oshkosh, WI, was burglarized on October 23, 2015, and an unencrypted laptop computer was stolen. Highly sensitive data were stored on the laptop, including the medical records and personal information of an undisclosed number of patients. Social Security numbers, details of mental health status, and the results of psychological tests could potentially have been accessed and viewed by the thieves.

Other data believed to have been stored on the laptop include patient names, addresses, dates of birth, statements of work capacity, medical diagnoses, and medical histories. In total, 509 patients had their data compromised.

Affected patients had visited the Bay Shore Drive Fox River Counseling Center between Nov. 7, 2012, and Aug. 19, 2014. The laptop also included data relating to Wisconsin Disability Determination Bureau psychological evaluations that were conducted between May 13, 2013, and Oct. 21, 2015.

As soon as the break-in and theft were discovered, the Oshkosh police department was notified but the laptop computer has not been recovered.

The theft of equipment from medical facilities does not necessarily mean data will be accessed and used inappropriately. However, since the laptop was reported to be “an older model and was not secure,” there is a possibility that the data may be accessed by unauthorized individuals. It would be undoubtedly worth more than the laptop computer to an identity thief.

Patients are therefore at risk of harm and loss as a result of the theft. They have been advised by the center to change their passwords and monitor all of their accounts, as well as register with the three credit agencies to obtain a free credit report. They should also consider placing a credit alert on their file, or a credit freeze, to minimize the risk of loss.

All patients affected by the breach have now been notified of the equipment theft by mail and action has been taken to ensure that further data breaches do not occur. Security has been increased and data encryption has been used on the company’s computer equipment to keep patient data more secure in the future.

Author: Steve Alder has many years of experience as a journalist, and comes from a background in market research. He is a specialist on legal and regulatory affairs, and has several years of experience writing about HIPAA. Steve holds a B.Sc. from the University of Liverpool.