HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Potential ePHI Breach Impacts 3,600 Children’s Hospital Los Angeles Patients

3,594 patients of Children’s Hospital Los Angeles (CHLA) and Children’s Hospital Los Angeles Medical Group (CHLAMG) are being notified of a potential breach of their electronic protected health information following the theft of an unencrypted, password-protected laptop computer.

The laptop was stolen from the locked vehicle of a CHLAMG employee who practices at CHLA. The theft is understood to have occurred on October 18, 2016.

CHLAMG encrypts its laptop computers, and while the investigation into the breach initially indicated the laptop had been encrypted to institutional standards, on December 21, 2016, CHLA determined that there was a possibility that the device had not been encrypted.

Typically, laptops are stolen by thieves for the value of the device, not for data stored on the devices. Laptops are wiped, have software reinstalled, and are sold on.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

While it cannot be confirmed that this was the case in this instance, CHLA investigators were able to determine that the laptop computer has not been used to connect to the Internet since it was stolen, suggesting the device was wiped and ePHI is no longer accessible.

A CHLA spokesperson said their IT security systems allow data on laptop computers to be remotely and securely erased. The protocol for doing this has been activated and data on the device will be wiped should the device be used to connect to the Internet.  No evidence has been uncovered to suggest data have been accessed or used inappropriately. CHLA is continuing to work with law enforcement, although to date, the laptop computer has not been recovered.

The data stored on the device included children’s names, addresses, medical record numbers, birthdates, and limited clinical information.

Parents of affected children have been notified of the potential ePHI breach out of an abundance of caution. They have been advised to check Explanation of Benefits statements for medical services that have not been received.

CHLA will be enhancing its encryption levels on all laptop computers used by its physicians to prevent future data breaches of this nature from occurring.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.