HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Orleans Medical Clinic Notifies 6,890 Patients of PHI Breach

Orleans Medical Clinic in Indiana is notifying all current and former patients that their protected health information has potentially been accessed by an unauthorized individual.

On or around April 17, 2016, the clinic noticed suspicious activity on a server used to store patients’ PHI. Immediate action was taken to secure the server and prevent data access. An investigation was also launched to determine whether patient data had been viewed or copied by the attacker.

The investigation revealed that an external third party first gained access to the server on April 5, 2016 and access continued for a period of almost two weeks. Orleans Medical Clinic had conducted a server upgrade; however, after the work was completed the server was accidentally left unprotected. No evidence was uncovered to suggest that PHI was viewed or obtained by the hacker, but it was not possible to rule out the possibility that PHI was compromised.

The server was used to store the electronic medical records of patients. While no financial information was stored on the server, patients have potentially had their name, address, contact information, demographic data, date of birth, medical history, and Social Security number compromised.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

It is not clear why it took so long to notify patients of the breach. Improper PHI access was first discovered on April 17, but it took almost four months to send breach notification letters to patients. According to the substitute breach notice that was uploaded to the company’s website in the past few days, confirmation of the individuals affected by the breach was not received by the Clinic until July 21, 2016.

All current and former patients of the clinic have been offered complimentary identity theft protection services with Equifax Personal Solutions for a period of 12 months.

The incident has been reported to the Department of Health and Human Services’ Office for Civil Rights and an investigation has been initiated. The FBI and the Indiana Attorney General’s Office have also been informed of the security breach and each is conducting its own investigation. According to the OCR breach report, 6,890 patients have been affected.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.