HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Missouri Department of Health and Senior Services Contractor Improperly Retained 10,400 Individuals’ PHI

The Missouri Department of Health and Senior Services (MHSS) is notifying 10,400 patients of a data privacy incident involving some of their protected health information (PHI).

Under Health Insurance Portability and Accountability Act (HIPAA) Rules, HIPAA-covered entities are permitted to share patients’ PHI with contractors that perform certain duties on behalf of the covered entity.

The contractors, who are classed as business associates, must enter into a business associate agreement with the covered entity and agree to comply with HIPAA Rules. When the association ends, the business associates must return all PHI to the covered entity or, under the direction of the covered entity, ensure that the PHI is permanently and securely erased.

MHSS has discovered that an IT contractor has improperly retained the PHI of 10,400 patients after the contracted duties had been completed. Further, patients’ PHI was stored in an electronic file that was not password-protected.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

The IT contractor had worked on an information system used by the MHSS prior to September 30, 2016. On August 30, 2018, the DHSS learned that the PHI had been retained. Steps were immediately taken to secure the PHI. The DHSS has not stated in its substitute breach notice whether the PHI has now been recovered and secured.

According to the DHSS, the PHI contained in the electronic file that was provided to the contractor was limited in nature. The types of PHI in the file varied by person, but may have included names, dates of birth, state-issued identification numbers, and for a limited number of individuals, Social Security numbers.

The DHSS has not received any information to suggest that any of the information in the file has been misused in any way, but it has been recommended that patients remain vigilant for any sign of fraud and check their accounts statements and credit reports carefully for unusual activity.

The DHSS has referred the matter to the appropriate legal authority to investigate and determine whether legal action is appropriate.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.