PHI of 1,800 Patients Found Abandoned in Houston Street
Paperwork containing the protected health information of approximately 1,800 patients has been discovered abandoned in a Midtown, Houston street by an employee of the CBS-affiliated television station KBOU 11.
The paperwork contained information such as patients’ names, birth dates, diagnoses, treatment information, medications, vital signs, and admission dates. KBOU launched an investigation into the breach and determined the paperwork related to patients from five Houston hospitals – MD Anderson Cancer Center, LBJ Hospital, Children’s Memorial Hermann, Memorial Hermann Hospital, and TIRR Memorial Hermann. The investigation led to UT Health.
According to the report, the records were stolen from the locked trunk of a vehicle belonging of a medical resident who, while studying at UT Health’s McGovern Medical School, had worked at the above hospitals. The records were stolen from his vehicle in July.
Avail of a Free 30-Minute
Cybersecurity Consultation
with Blue Team Alpha
Review your security program, get advice on a specific cybersecurity concern, identify risk-reduction priorities, or take the first step toward your annual HIPAA Security Risk Assessment.
Learn More About This Offer
Officials at UT Health confirmed to KBOU that they are aware of the breach. Reporters spoke to the medical graduate and confirmed that the incident had not been reported to the police until after he had been contacted by KBOU reporters.
A spokesperson for UT Health issued a statement saying, “We promptly took steps to investigate the circumstances of the disclosure, which revealed that the stolen documents had been discarded on a city street and found a day later by an employee of KHOU-TV Channel 11.” The records were collected by that employee and were returned to UT Health and have now been secured. UT Health found no evidence to suggest that any information in the documents was viewed by unauthorized individuals.
It is unclear why the records were removed from the hospitals in the first place and why the theft was not reported to law enforcement immediately. The incident has been reported to the HHS’ Office for Civil Rights. The breach summary indicates 500 patients have been affected. According to UT Health, the affected hospitals will be issuing notifications to all affected patients in due course.
