Santa Barbara Public Health Dept. Announces HIPAA Privacy Rule Violation
It’s been a bad week for healthcare patients in Santa Barbara. First came the news that 11,000 patients of Cottage Health System had their Social Security numbers, medical data, and personal information exposed in a data breach. Now follows news that the Santa Barbara Public Health Department has suffered a privacy breach involving 260 individuals.
The breach occurred when an employee accessed the Protected Health Information of 260 individuals as part of a research project, but had not obtained prior authorization to access the data. Consequently, the employee violated the HIPAA Privacy Rule. The research project had not been authorized by the Public Health Dept., and the accessing of patient data was therefore illegal.
Credit monitoring services have been offered to a limited number of those patients as a precaution against identity theft and fraud. The member of staff in question has been disciplined, and access to PHI has now been denied. The Public Health Department does not believe that any of the data that were accessed were shared with any individuals from outside the department. The risk of harm or loss being suffered by the breach victims is therefore believed to be low.
All members of staff had previously received training; however, the HIPAA privacy rule violation prompted the Santa Barbara Public Health Department to re-train staff on data privacy and security matters. All patients affected by the data breach have been notified by mail of the violation of their privacy.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Accessing of PHI for Research Purposes
Access to Protected Health Information is permitted under the Health Insurance Portability and Accountability Act for the purposes of research; however, prior consent must be obtained from patients before their data can be accessed, shared, or disclosed for this purpose. That said, it is possible for a limited data set to be used for research purposes without prior authorization having first been obtained from patients, provided data have first been de-identified.
De-identification of data removes information that ties the data to an individual. In such cases, the recipient of the data must agree to implement safeguards to protect data contained in the limited data set prior to receiving any PHI.
