HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Patients Notified of KinetoRehab Physical Therapy Laptop Theft

New York-based KinetoRehab Physical Therapy has started sending HIPAA breach notification letters to patients alerting them to the potential exposure of some of their protected health information.

On September 16, 2016, KinetoRehab discovered a laptop computer was missing from its facilities. A review of security camera footage revealed the laptop computer had been stolen. While the laptop bag has now been found, the laptop computer had been removed and has not been recovered. The incident was reported to law enforcement and efforts are currently being made to locate the individual identified from the CCTV camera footage.

The laptop contained data on a limited number of patients, although those affected by the breach have had highly sensitive information exposed. The laptop contained patients’ names, birthdates, Social Security numbers, insurance information, and notes relating to the physical therapy provided by the clinic. Patients affected by the incident had visited KinetoRehab Physical Therapy for treatment between November 2011 and March 2013.

While the data stored on the device could potentially be accessed by unauthorized individuals, there is no indication that data have been accessed or that they will be used inappropriately. However, since highly sensitive information has been exposed, KinetoRehab Physical Therapy is offering all affected patients 12 months of credit monitoring and identity theft protection through Experian’s® ProtectMyID® Alert or Family Secure®.

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

KinetoRehab Physical Therapy has informed patients “We have taken every step necessary to address the incident, and that we are committed to fully protecting all the information that has been entrusted to us.” A review of the organizations technical safeguards is being conducted and improvements will be made to prevent similar incidents from occurring in the future.

The ePHI breach has been reported to the New York Attorney General and the Department of State’s Division of Consumer Protection. The breach report submitted to the Department of Health and Human Services’ Office for Civil Rights indicates 665 individuals have been affected.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.