HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Unauthorized Email Exposes PHI of 855 Advanced Radiology Consultants Patients

On July 24, Advanced Radiology Consultants, LLC., announced a data security event that exposed the data of a small subset of its patients. The breach report submitted to the Department of Health and Human Services’ Office for Civil Rights indicates 855 patients have been affected.

The data breach was caused when an employee of the company emailed a list of patients’ PHI to a personal email account. The list of data included patient names, telephone numbers, dates of birth, balance information, patient identification numbers, examination results, treatment information, appointment dates and times, appointment notes, referring physician names, insurance provider, and insurance identification numbers.

Advanced Radiology Consultants confirmed in a press release that no Social Security numbers, credit card numbers, driver’s license numbers or financial account information were included in the email. That said, the information that was copied and emailed outside the healthcare providers’ network did contain enough data to enable the employee to file false insurance claims, and potentially commit identity fraud.

No information was provided on the motives behind the sending of the email, although Advanced Radiology Consultants confirmed that the employee’s contract was terminated as a result of the data breach, and law enforcement has been alerted to the HIPAA breach. The law enforcement investigation is ongoing.

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

Upon discovery of the data breach on May 28, 2015, Advanced Radiology Consultants initiated an internal investigation and enlisted the help of a private security firm to conduct a full forensic data analysis. The employee was questioned and instructed to delete the email from her account, which she has confirmed has now been done. She told the company she had not used the data “in an unauthorized manner” and neither did she disclose any information to a third party. The risk of the data being used to commit fraud, or for any other malicious purpose, is believed to be low, and no further risk is now understood to exist.

However, since this cannot be confirmed by Advanced Radiology Consultants, the company has taken the decision to offer credit monitoring, identity theft protection and identity restoration services to all affected patients. The services will be provided by Experian for a period of 12 months. Patients have also been advised to monitor their credit, and since insurance information has been compromised, also check explanation of benefits statements carefully for any sign of fraudulent activity. Breach notification letters were dispatched to affected patients on July 24, 2015.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.