Unauthorized Email Exposes PHI of 855 Advanced Radiology Consultants Patients
On July 24, Advanced Radiology Consultants, LLC., announced a data security event that exposed the data of a small subset of its patients. The breach report submitted to the Department of Health and Human Services’ Office for Civil Rights indicates 855 patients have been affected.
The data breach was caused when an employee of the company emailed a list of patients’ PHI to a personal email account. The list of data included patient names, telephone numbers, dates of birth, balance information, patient identification numbers, examination results, treatment information, appointment dates and times, appointment notes, referring physician names, insurance provider, and insurance identification numbers.
Advanced Radiology Consultants confirmed in a press release that no Social Security numbers, credit card numbers, driver’s license numbers or financial account information were included in the email. That said, the information that was copied and emailed outside the healthcare providers’ network did contain enough data to enable the employee to file false insurance claims, and potentially commit identity fraud.
No information was provided on the motives behind the sending of the email, although Advanced Radiology Consultants confirmed that the employee’s contract was terminated as a result of the data breach, and law enforcement has been alerted to the HIPAA breach. The law enforcement investigation is ongoing.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Upon discovery of the data breach on May 28, 2015, Advanced Radiology Consultants initiated an internal investigation and enlisted the help of a private security firm to conduct a full forensic data analysis. The employee was questioned and instructed to delete the email from her account, which she has confirmed has now been done. She told the company she had not used the data “in an unauthorized manner” and neither did she disclose any information to a third party. The risk of the data being used to commit fraud, or for any other malicious purpose, is believed to be low, and no further risk is now understood to exist.
However, since this cannot be confirmed by Advanced Radiology Consultants, the company has taken the decision to offer credit monitoring, identity theft protection and identity restoration services to all affected patients. The services will be provided by Experian for a period of 12 months. Patients have also been advised to monitor their credit, and since insurance information has been compromised, also check explanation of benefits statements carefully for any sign of fraudulent activity. Breach notification letters were dispatched to affected patients on July 24, 2015.
