Transcription Service Provider Exposes PHI of Children’s National Health System Patients
Washington D.C.-based Children’s National Health System (CNHS) has alerted patients to a breach of their protected health information following an error by a transcription service provider which allowed patients’ data to be indexed by the search engines. CNHS is one of a number of healthcare clients affected by the data breach.
Ascend Healthcare Systems was contracted by CNHS to transcribe physician’s notes and was supplied with transcription documents in 2014; however, those documents could potentially have been accessed via search engines due to a misconfiguration with a File Transfer Protocol (FTP) site.
Transcription services were provided to CNHS by Ascend between May 1, 2014 and June 23, 2014; however, on February 25, 2016, CNHS discovered that some of its patients’ data had been exposed online.
An investigation into the privacy breach was immediately launched and CNHS determined that for a period of one week in February, data were accessible via Google. The breach is understood to have lasted between February 19 and February 25, 2016.
The data stored in the transcription documents included patients’ names, birth dates, prescribed medications, and notes made by physicians. The notes included medical diagnoses and prescribed treatments. Social Security numbers, medical insurance details, financial information, and credit card numbers were not exposed.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The only patients affected by the incident were those whose notes were sent to Ascend by CNHS between May 1 and June 23, 2014. According to the breach report submitted to the Department of Health and Human Services’ Office for Civil Rights, 4,107 patients were affected by the privacy incident.
Upon discovery of the privacy breach, CNHS contacted Ascend and demanded action be taken to secure the data and ensure that access via the search engines was prevented. According to CNHS, when the contract with Ascend was terminated on June 23, 2014, Ascend was required to delete all of the data supplied by CNHS. Ascend has assured CNHS that all of data have been deleted and there is no further risk of exposure.
CNHS notified all affected patients of the privacy breach by mail on April 2016, and has not received any reports that data have been misused.
