HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Thieves Stole Devices Containing PHI of 7,200 Patients of Integrity House

A burglary at the offices of the addiction treatment services provider Integrity House has resulted in the exposure of patients’ protected health information.

Several electronic devices were stolen in the burglary, including desktop computers, laptop computers and tablets. An investigation by the Integrity House IT team confirmed that some patients’ protected health information was stored on the devices.

The burglary was discovered by staff on November 25, 2018. Law enforcement was notified but the stolen devices have not been recovered. The IT department determined that one of the stolen devices contained information such as names, birth dates, Social Security numbers, health insurance information, and a limited amount of treatment information.

While it is probable that the devices were stolen for their resale value rather than any sensitive information they contained, it is possible that patient information could be accessed and may be misused. Consequently, as a precaution, Integrity House has offered all affected individuals free identity theft protection and credit monitoring services.

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

The burglary has prompted Integrity House to implement additional safeguards to prevent further incidents of this nature from occurring and has taken steps to improve privacy protections for patients. These include augmenting physical security in all facilities, strengthening passwords, implementing additional policies concerning the handling of personal information, and the use of encryption on all hard drives.

“The privacy and protection of personal information is a top priority for Integrity House and we sincerely apologize for any concern or inconvenience that this may cause,” wrote Integrity House in its substitute breach notice.

All individuals affected by the breach have now been notified by mail and the incident has been reported to the Department of Health and Human Services’ Office for Civil Rights.

The breach summary on the OCR website indicates the PHI of 7,206 individuals was stored on the stolen devices.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.