HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Theft of HIPAA Records Reported by Texas Healthcare Provider

Hunt Regional Medical Partners, a healthcare provider in Texas, has reported a break in at its Westlake facilities in which an undisclosed number of healthcare records were obtained by thieves. The property was vandalized and old paper medical files of patients who had visited the Hunt Regional Medical Partners Family Practice (HRMP) at Westlake before 2010 were taken. The practice had recently been acquired by the healthcare provider and was previously known as Westlake Medical Center.

It is not clear at this stage exactly what information was disclosed in the incident, although according to the breach notice issued by HRMP, the information potentially included Social Security numbers and health information along with personal identifiers making this a HIPAA breach.

The vandalizing of the premises and theft of data have been reported to law enforcement officers and an investigation was immediately launched. Breach notification letters have now been sent to all affected individuals, and due to the increased risk of suffering medical or identity fraud, credit monitoring services are being offered by HRMP to any individual affected by the data breach.

In order to activate the fraud monitoring service, victims are required to take action. The first step to take is to contact one of the three main credit monitoring agencies – Experian, Equifax and TransUnion – to initiate a fraud alert. When a fraud alert is received, the other two bureaus are notified. It is advisable to obtain a free credit report from all three agencies to ensure no fraud has already been committed.

Please see the HIPAA Journal Privacy Policy

It is not clear whether the property where the PHI was being stored was appropriately protected. Under the HIPAA Security Rule, healthcare providers and other covered entities must implement physical controls to safeguard health records. That will be a matter for the OCR and state investigators to investigate to determine if there has been a HIPAA violation.

According to Chad Martin, Director of HRMP, “The protection of private information is something we take very seriously” he also said “We have relocated the records and are reviewing internal procedures to determine added safeguards for the future.”

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.