HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

North Carolina Department of Health and Human Services Email Breach Impacts 12,700

The North Carolina Department of Health and Human Services has announced that the names, addresses, and Medicaid numbers of 12,731 patients were exposed as a result of an email error. The data were sent via email to adult care homes last year, but the emails were not encrypted. Potentially, the emails could have been intercepted and the data obtained by individuals unauthorized to view the information.

The emails were sent on November 30, 2016 and the Department of Health and Human Services’ Office for Civil Rights has now been notified of the incident. No mention has been made of when the incident was discovered.

This is the third such incident of this nature to have affected the NC Department of Health and Human Services in the past 38 months.

On December 30, 2013, 49,000 Medicaid cards of minors were accidentally mailed to incorrect recipients, exposing Medicaid numbers, names and birth dates. The privacy breach was attributed to human error. Two years later, 1,615 patients were impacted when an unencrypted email containing was sent to the Granville County Health Department. The email contained a spreadsheet containing names, Medicaid ID numbers, provider’s name and ID number, and other Medicaid related information.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

The two email incidents are not believed to have resulted in any individual’s data being compromised. No indications that the emails were intercepted has been found by the NC Department of Health and Human Services, although the possibility cannot be ruled out. Individuals affected by the latest incident have been advised to monitor their accounts for any signs of fraud as a precaution.

In order to prevent similar security breaches from occurring in the future, policies and procedures have now been changed. Rather than emailing Medicaid numbers and names, identification numbers will be used in future. Should any email messages be intercepted, it would not be possible for patients to be identified.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.