HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Success 4 Kids & Families Reports Data Breach

Success 4 Kids & Families (S4KF) has sent breach notification letters to 506 patients informing them of a data breach that has potentially exposed some of their Protected Health Information (PHI).

An employee of the Hillsborough County-based provider of in-home treatment services left an unencrypted laptop computer in a vehicle from where it was subsequently stolen.

S4KF was informed of the theft on April 5 and immediately reported the theft to law enforcement. An investigation was launched, but the laptop has not yet been recovered.

S4KF hired an external security firm to determine the exact data stored on the laptop, with the investigation establishing that the computer contained patient names, dates of birth, age, gender, home addresses, Social Security numbers, insurance provider’s name and the types of service received. No other healthcare data was exposed in the incident.

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

There is no reason to suggest that the laptop was stolen for the data it contained, but there is a risk that the information stored on the laptop could be used inappropriately. Social Security numbers can be used to file false tax returns, steal identities and criminals can run up huge debts in the name of the victim.

Since patients now face an elevated risk of suffering identity fraud they have been advised to sign up for credit and identity theft monitoring services. S4KF is offering these service to patients without charge for a period of one year.

HIPAA Rules on Data Encryption

It is not mandatory for PHI to be encrypted under the Health Insurance Portability and Accountability Act (HIPAA). Data encryption is only ‘addressable’ area, which means that healthcare providers and other holders of PHI must assess the need for data encryption. The decision not to encrypt data must only be made after a complete risk assessment has been performed. If the risk of data exposure is perceived to be low, it may be more appropriate to use other technical safeguards to keep PHI secure.

However, a failure to implement any controls to safeguard PHI is a breach of HIPAA Rules and can potentially result in a fine from the Department of Health and Human Services’ Office for Civil Rights. The maximum fine for willful neglect of HIPAA Rules is $1.5 million per violation.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.