Mental Health Counseling Records Stolen in Office Burglary
The Fox River Counseling Center on Bay Shore Drive, Oshkosh, WI, was burglarized on October 23, 2015, and an unencrypted laptop computer was stolen. Highly sensitive data were stored on the laptop, including the medical records and personal information of an undisclosed number of patients. Social Security numbers, details of mental health status, and the results of psychological tests could potentially have been accessed and viewed by the thieves.
Other data believed to have been stored on the laptop include patient names, addresses, dates of birth, statements of work capacity, medical diagnoses, and medical histories. In total, 509 patients had their data compromised.
Affected patients had visited the Bay Shore Drive Fox River Counseling Center between Nov. 7, 2012, and Aug. 19, 2014. The laptop also included data relating to Wisconsin Disability Determination Bureau psychological evaluations that were conducted between May 13, 2013, and Oct. 21, 2015.
As soon as the break-in and theft were discovered, the Oshkosh police department was notified but the laptop computer has not been recovered.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The theft of equipment from medical facilities does not necessarily mean data will be accessed and used inappropriately. However, since the laptop was reported to be “an older model and was not secure,” there is a possibility that the data may be accessed by unauthorized individuals. It would be undoubtedly worth more than the laptop computer to an identity thief.
Patients are therefore at risk of harm and loss as a result of the theft. They have been advised by the center to change their passwords and monitor all of their accounts, as well as register with the three credit agencies to obtain a free credit report. They should also consider placing a credit alert on their file, or a credit freeze, to minimize the risk of loss.
All patients affected by the breach have now been notified of the equipment theft by mail and action has been taken to ensure that further data breaches do not occur. Security has been increased and data encryption has been used on the company’s computer equipment to keep patient data more secure in the future.
