Missouri Department of Health and Senior Services Contractor Improperly Retained 10,400 Individuals’ PHI
The Missouri Department of Health and Senior Services (MHSS) is notifying 10,400 patients of a data privacy incident involving some of their protected health information (PHI).
Under Health Insurance Portability and Accountability Act (HIPAA) Rules, HIPAA-covered entities are permitted to share patients’ PHI with contractors that perform certain duties on behalf of the covered entity.
The contractors, who are classed as business associates, must enter into a business associate agreement with the covered entity and agree to comply with HIPAA Rules. When the association ends, the business associates must return all PHI to the covered entity or, under the direction of the covered entity, ensure that the PHI is permanently and securely erased.
MHSS has discovered that an IT contractor has improperly retained the PHI of 10,400 patients after the contracted duties had been completed. Further, patients’ PHI was stored in an electronic file that was not password-protected.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The IT contractor had worked on an information system used by the MHSS prior to September 30, 2016. On August 30, 2018, the DHSS learned that the PHI had been retained. Steps were immediately taken to secure the PHI. The DHSS has not stated in its substitute breach notice whether the PHI has now been recovered and secured.
According to the DHSS, the PHI contained in the electronic file that was provided to the contractor was limited in nature. The types of PHI in the file varied by person, but may have included names, dates of birth, state-issued identification numbers, and for a limited number of individuals, Social Security numbers.
The DHSS has not received any information to suggest that any of the information in the file has been misused in any way, but it has been recommended that patients remain vigilant for any sign of fraud and check their accounts statements and credit reports carefully for unusual activity.
The DHSS has referred the matter to the appropriate legal authority to investigate and determine whether legal action is appropriate.
