Santa Barbara Public Health Dept. Announces HIPAA Privacy Rule Violation

It’s been a bad week for healthcare patients in Santa Barbara. First came the news that 11,000 patients of Cottage Health System had their Social Security numbers, medical data, and personal information exposed in a data breach. Now follows news that the Santa Barbara Public Health Department has suffered a privacy breach involving 260 individuals.

The HIPAA privacy rule violation occurred when an employee accessed Protected Health Information of 260 individuals as part of a research project, but had not obtained prior authorization to access the data. Consequently, the employee breached the HIPAA Privacy Rule. The research project had not been authorized by the Public Health Dept., and the accessing of patient data was therefore illegal.

Credit monitoring services have been offered to a limited number of those patients as a precaution against identity theft and fraud. The member of staff in question has been disciplined, and access to PHI has now been denied. The Public Health Department does not believe that any of the data that were accessed were shared with any individuals from outside the department. The risk of harm or loss being suffered by the breach victims is therefore believed to be low.

All members of staff had previously received training; however, the HIPAA privacy rule violation prompted the Santa Barbara Public Health Department to re-train staff on data privacy and security matters. All patients affected by the data breach have been notified by mail of the violation of their privacy.

Accessing of PHI for Research Purposes

Access to Protected Health Information is permitted under the Health Insurance Portability and Accountability Act for the purposes of research; however prior consent must be obtained from patients before their data can be accessed, shared, or disclosed for this purpose. That said, it is possible for a limited data set to be used for research purposes without prior authorization having first been obtained from patients, provided data have first been de-identified.

De-identification of date removes information that ties the data to an individual. In such cases the recipient of the data must agree to implement safeguards to protect data contained in the limited data set prior to receiving any PHI. (HHS: Permitted Uses and Disclosures (6)).

Author: Steve Alder has many years of experience as a journalist, and comes from a background in market research. He is a specialist on legal and regulatory affairs, and has several years of experience writing about HIPAA. Steve holds a B.Sc. from the University of Liverpool.