U.S. HealthWorks Announces Theft of Encrypted Laptop and Decryption Key
Healthcare providers can use data encryption to ensure that the theft of portable devices does not result in the exposure of patients’ protected health information. However, encryption is not infallible, as U.S. HealthWorks has discovered.
A laptop computer containing the PHI of 1,400 patients was recently stolen from a U.S. HealthWorks employee. While this would not usually result in the issuing of breach notifications to patients, in this case the employee had written down the password to access the device and decrypt data. The password was kept with the laptop and it was also stolen.
Upon discovery of the theft of the device along with the password, U.S. HealthWorks conducted a full investigation to determine which patients may have had their PHI exposed.
The investigation did not uncover evidence to suggest that any data have been used inappropriately, and the possibility remains that the data stored on the device were not accessed. However, if the thief were to use the password to gain access to the device, it would be possible to access emails which contained sensitive information on patients.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The emails contained a limited amount of PHI including names and medical information such as visit dates, medical diagnoses, and health insurance information. Some patients may also have had their Social Security number exposed, although no financial information or other account details were present in any of the emails on the device.
U.S. HealthWorks is taking steps to reduce the risk of future security breaches by re-training employees on information security. Policies and procedures have also been reviewed and are being revised as appropriate, in particular policies and procedures regarding the security of laptop computers and the use of passwords.
The theft occurred on July 18, 2016 and patients were notified of the potential exposure of their PHI on September 2, 2016.
