Stolen Ultrasound Machines Contained PHI, says Kaiser Permanente
Kaiser Permanente discovered that some of its ultrasound machines and other medical equipment had been stolen by two company employees. Kaiser Permanente was alerted to the theft of equipment on June 10 and immediately launched an investigation. Efforts were then made to recover the missing equipment.
Kaiser Permanente has now recovered the stolen equipment and has performed an analysis to determine whether any patient data were stored on the devices.
Kaiser Permanente determined that some of the machines contained a limited amount of patients’ protected health information including MRN’s, patients first and last names, and ultrasound images.
The equipment had been taken from a number of different Kaiser Permanente facilities and had been temporarily moved to a storage unit. The Kaiser Permanente investigation is ongoing, but it is believed that the ultrasound machines and medical equipment were only taken by the employees to sell on for profit, and not for any data stored on the devices. The theft of equipment has been reported to law enforcement and a criminal investigation has been launched.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Patients affected by the privacy incident are now being sent HIPAA breach notification letters by mail. Kaiser Permanente does not believe patients’ data have been accessed or used inappropriately, nor that the employees had any intention of using the data stored on the ultrasound machines. The risk of inappropriate use of the data would be limited in any case since no insurance information, Social Security numbers, or financial information were stored on the machines. Patients therefore face a low risk of harm or loss as a result of the breach.
The Incident has been reported to the California Attorney General, but the breach report has yet to appear on the U.S. Department of Health and Human Services’ Office for Civil Rights breach portal. At the time of publication, it is unclear exactly how many patients have been affected.
