HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Transcription Service Provider Exposes PHI of Children’s National Health System Patients

Washington D.C.-based Children’s National Health System (CNHS) has alerted patients to a breach of their protected health information following an error by a transcription service provider which allowed patients’ data to be indexed by the search engines. CNHS is one of a number of healthcare clients affected by the data breach.

Ascend Healthcare Systems was contracted by CNHS to transcribe physician’s notes and was supplied with transcription documents in 2014; however, those documents could potentially have been accessed via search engines due to a misconfiguration with a File Transfer Protocol (FTP) site.

Transcription services were provided to CNHS by Ascend between May 1, 2014 and June 23, 2014; however, on February 25, 2016, CNHS discovered that some of its patients’ data had been exposed online.
An investigation into the privacy breach was immediately launched and CNHS determined that for a period of one week in February, data were accessible via Google. The breach is understood to have lasted between February 19 and February 25, 2016.

The data stored in the transcription documents included patients’ names, birth dates, prescribed medications, and notes made by physicians. The notes included medical diagnoses and prescribed treatments. Social Security numbers, medical insurance details, financial information, and credit card numbers were not exposed.

Get The Checklist

Free and Immediate Download
HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

The only patients affected by the incident were those whose notes were sent to Ascend by CNHS between May 1 and June 23, 2014. According to the breach report submitted to the Department of Health and Human Services’ Office for Civil Rights, 4,107 patients were affected by the privacy incident.

Upon discovery of the privacy breach, CNHS contacted Ascend and demanded action be taken to secure the data and ensure that access via the search engines was prevented. According to CNHS, when the contract with Ascend was terminated on June 23, 2014, Ascend was required to delete all of the data supplied by CNHS. Ascend has assured CNHS that all of data have been deleted and there is no further risk of exposure.

CNHS notified all affected patients of the privacy breach by mail on April 2016, and has not received any reports that data have been misused.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.