HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

PHI of Almost 1,000 Lebanon VA Medical Center Patients Impermissibly Disclosed

Lebanon VA Medical Center in Pennsylvania has discovered the protected health information of hundreds of elderly patients has been impermissibly disclosed to a family member of a veteran.

In November 2018, a member of staff at Lebanon VA Medical Center emailed a document to a family member of a veteran who was searching for nursing home facilities. The list should have contained nursing home facilities that work with the Department of Veteran Affairs; however, a historical list of residents of nursing homes was sent in error.

The list contained veterans’ names, abbreviated Social Security numbers, the nursing home where the veteran had been admitted, diagnoses, and service-connection disability rating percentages.

“Lebanon VA Medical Center and our employees take our responsibility to protect patient information very seriously,” explained Lebanon VA privacy officer Tonya Hromco. “Along with assistance from national offices, we immediately investigated this inadvertent, unauthorized release of information which occurred in late November.”

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

The incident was an isolated error and steps have now been taken to reduce the potential for further mistakes. Additional controls have been implemented in the section where the error occurred and throughout its facility. Files containing historic information have now been encrypted and restrictions have been placed on the number of individuals with access to those files. Technical controls have also been implemented that prevent members of the department from sending email attachments externally.

A press release issued by Lebanon VA Medical Center says the PHI of 993 individuals was impermissibly disclosed. The breach report on the HHS’ Office for Civil Rights’ breach portal suggests the breach could have impacted up to 1,002 individuals.

Individuals affected by the privacy breach and family members of deceased patients have recently been mailed breach notification letters.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.