Success 4 Kids & Families Reports Data Breach
Success 4 Kids & Families (S4KF) has sent breach notification letters to 506 patients informing them of a data breach that has potentially exposed some of their Protected Health Information (PHI).
An employee of the Hillsborough County-based provider of in-home treatment services left an unencrypted laptop computer in a vehicle from where it was subsequently stolen.
S4KF was informed of the theft on April 5 and immediately reported the theft to law enforcement. An investigation was launched, but the laptop has not yet been recovered.
S4KF hired an external security firm to determine the exact data stored on the laptop, with the investigation establishing that the computer contained patient names, dates of birth, age, gender, home addresses, Social Security numbers, insurance provider’s name and the types of service received. No other healthcare data was exposed in the incident.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
There is no reason to suggest that the laptop was stolen for the data it contained, but there is a risk that the information stored on the laptop could be used inappropriately. Social Security numbers can be used to file false tax returns, steal identities and criminals can run up huge debts in the name of the victim.
Since patients now face an elevated risk of suffering identity fraud they have been advised to sign up for credit and identity theft monitoring services. S4KF is offering these service to patients without charge for a period of one year.
HIPAA Rules on Data Encryption
It is not mandatory for PHI to be encrypted under the Health Insurance Portability and Accountability Act (HIPAA). Data encryption is only ‘addressable’ area, which means that healthcare providers and other holders of PHI must assess the need for data encryption. The decision not to encrypt data must only be made after a complete risk assessment has been performed. If the risk of data exposure is perceived to be low, it may be more appropriate to use other technical safeguards to keep PHI secure.
However, a failure to implement any controls to safeguard PHI is a breach of HIPAA Rules and can potentially result in a fine from the Department of Health and Human Services’ Office for Civil Rights. The maximum fine for willful neglect of HIPAA Rules is $1.5 million per violation.
