HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Potential PHI Exposure Reported by Californian Dentist

LA dental surgeon Dr. John Gonzalez DDS has notified 1,025 patients of a potential breach of protected health information following the theft of a portable hard drive from his vehicle. The hard drive was in a briefcase that was stolen from the locked vehicle on Monday July 25, 2016.

Data stored on the hard drive includes the names of patients, addresses, phone numbers, dates of birth, email addresses, dental x-ray images, health information, the last four digits of credit card numbers, driver’s license numbers, and social security numbers.

The data were not encrypted, although most of the information on the backup drive could only be accessed using specific dental software. Data that could be accessed without the use of specialist software is limited to jpeg x-ray images of patients’ teeth. Those images also contain patients’ names and telephone numbers.

The risk to harm to patients is believed to be low. The break-in occurred in a commercial parking lot and the hard drive was not visible. It is therefore unlikely that the thief stolen the briefcase in order to gain access to patient data. Dr. John Gonzalez has consulted the company that supplied the HIPAA-compliant dental software and has been assured that the data cannot be accessed without specialist software. Gonzalez has told patients, “All data of patient records is in unreadable format; it cannot be opened without extreme effort, costly purchases, and expert guidance.”

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

Additional precautions have been taken to increase security including registering a PIN with the dental software company to prevent unauthorized accessing of patient data. Caller ID verification has also been set up with the company.

Patients have been informed of the exposure of their data in accordance with HIPAA Rules and the Department of Health and Human Services’ Office for Civil Rights has been notified of the potential breach. The theft has been reported to law enforcement, although the stolen drive has not been recovered.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.