HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

PHI of 1,800 Patients Found Abandoned in Houston Street

Paperwork containing the protected health information of approximately 1,800 patients has been discovered abandoned in a Midtown, Houston street by an employee of the CBS-affiliated television station KBOU 11.

The paperwork contained information such as patients’ names, birth dates, diagnoses, treatment information, medications, vital signs, and admission dates. KBOU launched an investigation into the breach and determined the paperwork related to patients from five Houston hospitals – MD Anderson Cancer Center, LBJ Hospital, Children’s Memorial Hermann, Memorial Hermann Hospital, and TIRR Memorial Hermann. The investigation led to UT Health.

According to the report, the records were stolen from the locked trunk of a vehicle belonging of a medical resident who, while studying at UT Health’s McGovern Medical School, had worked at the above hospitals. The records were stolen from his vehicle in July.

Officials at UT Health confirmed to KBOU that they are aware of the breach. Reporters spoke to the medical graduate and confirmed that the incident had not been reported to the police until after he had been contacted by KBOU reporters.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

A spokesperson for UT Health issued a statement saying, “We promptly took steps to investigate the circumstances of the disclosure, which revealed that the stolen documents had been discarded on a city street and found a day later by an employee of KHOU-TV Channel 11.” The records were collected by that employee and were returned to UT Health and have now been secured. UT Health found no evidence to suggest that any information in the documents was viewed by unauthorized individuals.

It is unclear why the records were removed from the hospitals in the first place and why the theft was not reported to law enforcement immediately. The incident has been reported to the HHS’ Office for Civil Rights. The breach summary indicates 500 patients have been affected. According to UT Health, the affected hospitals will be issuing notifications to all affected patients in due course.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.