New York Physician Notifies Patients of Exposure of their PHI
A New York physician has started notifying patients that their protected health information has been exposed and has been potentially accessed unauthorized individuals.
Ruben U. Carvajal, MD was alerted to a possible privacy breach on January 3, 2018 and was informed that some of his patients’ health information was accessible over the Internet. An investigation into the possible privacy breach was launched and the matter was reported to the New York Police Department and the Federal Bureau of Investigation (FBI).
FBI investigators visited his office and examined his computer. On February 18, 2018, the FBI confirmed that the EMR program on his computer had been accessed by an unauthorized individual. A forensic investigator was called in to conduct a thorough investigation to determine the nature and scope of the breach.
On May 22, 2018 the forensic investigator determined that the physician’s computer had been accessed by an unauthorized individual between December 16, 2017 and January 3, 2018.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Any individual that gained access to the physicians’ computer could have gained access to the EMR system, although the forensic investigation did not confirm whether the program was accessed, although based on the findings of the FBI it can be assumed that this was the case.
The types of information that were potentially viewed and/or copied included names, addresses, birthdates, medical histories, diagnoses, treatment information, lab test results, medications, health insurance details, and claims information. Patients that receive Medicare also had their Medicare ID numbers and Social Security numbers exposed.
Dr. Carvajal started notifying patients about the breach on July 17, 2018 and patients have been offered complimentary credit monitoring and identity theft protection services. Steps have now been taken to improve security to prevent similar breaches from occurring in the future.
The breach report submitted to the Department of Health and Human Services’ Office for Civil Rights indicates 3,775 patients have had their protected health information exposed.
