PHI of 28,000 Mental Health Patients Allegedly Stolen by Healthcare Employee
Center for Health Care Services (CHCS) in San Antonio, a provider of mental health treatment and support services for individuals with intellectual and developmental disabilities, has discovered documents containing the protected health information of patients have been stolen by a former employee.
Breach notification letters have been sent to 28,434 patients who received services at CHCS before the summer of 2016 informing them of the breach.
The breach was only discovered on November 7, 2017, but the data theft occurred more than 17 months ago. The former employee was terminated on May 31, 2016, with the data downloaded onto a personal laptop after the individual was fired, according to a recent CHCS press release.
The breach came to light during discovery in a litigation case between the former employee and CHCS. No details have been released about the nature of the litigation.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The stolen documents contained a wide range of highly sensitive data on patients, including adults and children. The data included names, dates of birth, addresses, Social Security numbers, dates and types of services, medical record numbers, referral information, progress notes, medical diagnoses, medications prescribed, treatment plans, laboratory and toxicology reports, death certificates, autopsy reports, discharge dates, death summaries, and collateral hospital information.
The reason why the former employee took the data is unclear, although it does not appear that the information has been used for malicious purposes. CHCS believes the information has not been shared with any unauthorized individuals, other than the former employee’s attorneys. CHCS attorneys have also reportedly obtained a copy of the data.
According to the CHCS news release, patients are not believed to be at risk and there are no actions that need to be taken by patients as a result of the breach. Patients will be informed if the situation changes.
A spokesperson for CHCS said, “Attorneys for CHCS are seeking a protective order to prevent further disclosure of the information, and to verify deletion of the information as soon as the court permits.” CHCS is also taking steps to ensure security is improved to prevent future breaches of this nature from occurring.
