Rotech Healthcare Reports 967-Record PHI Breach

The protected health information of 967 patients of Orlando, FL-based Rotech Healthcare Inc., has been discovered in the residence of third party who was unauthorized to have the information. Rotech Healthcare, a provider of respiratory and sleep apnea equipment, was notified of the PHI breach by law enforcement officers on June 13, 2016.

The data listed on the recovered documents include names, addresses, patient ID numbers, Social Security numbers, phone numbers, dates of birth, and the name of the facility where patients received healthcare services. The data appears to have been taken from Rotech Systems; a subsidiary of Rotech Healthcare Inc.

It is not clear at this stage how the data came to be in the possession of an unauthorized individual, but a full investigation is underway. Rotech Healthcare has enlisted the services of a third party cybersecurity firm to perform a forensic analysis of its systems to determine the source of the breach.

While the breach was discovered in June and Rotech was informed of the incident promptly, it has taken some time to recover the documents, hence the delay in issuing breach notification letters to patients. Rotech’s breach notice indicates the data were only received from the U.S. Secret Service on July 11.

The Department of Health and Human Services’ Office for Civil Rights has been informed of the breach and breach notification letters will be sent to patients once the recovered documents have been checked. Patients should receive notification letters in the next few days.

Rotech Vice President of Compliance and Ethics, R. Wayne Bradberry, CHC., issued a statement saying “Rotech takes your privacy and the security of your personal and protected health information very seriously, and we are cooperating with law enforcement’s investigation into this incident.”

In order to prevent similar breaches from occurring, Rotech will be conducting a full review of its policies and procedures and security controls will be enhanced accordingly.

Author: Steve Alder has many years of experience as a journalist, and comes from a background in market research. He is a specialist on legal and regulatory affairs, and has several years of experience writing about HIPAA. Steve holds a B.Sc. from the University of Liverpool.