University of Michigan Health System Reports 4000-Patient HIPAA Breach
The University of Michigan Health System (UMHS) has announced that the records of 4000 patients may have been exposed by Omnicell, its supply management system vendor.
The data breach affected the patients of three hospitals operated by the University of Michigan Health System, all of whom had visited for consultations between October 24th, 2012 and November 13, 2012. The unencrypted data was stored on an unnamed device that was stolen from a car belonging to an Omnicell employee. This is a violation of the data privacy and security policies in place at UMHS.
The lost data was limited to medications prescribed, demographics, and some other health information; although UMHS confirmed that no Social Security numbers or credit card details were compromised in the incident. Names were included but no addresses or phone numbers were present in the data.
Pursuant to the Health Insurance Portability and Accountability Act, UMHS is in the process of notifying all individuals affected by the breach in writing to alert them to the possibility that their personal health information could be used to commit medical and identity fraud. The breach letter advises patients to monitor their finances and credit for signs of any fraudulent activity, although it is believed that the risk of fraudulent activity is low.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
While data security policies and procedures had been implemented to protect the Protected Health Information of patients – and also to comply with HIPAA regulations – questions must be asked about why the vendor was in possession of unencrypted data and under what circumstances the data was required to be taken out of the vendor’s facilities.
This incident highlights the need for Healthcare providers to communicate the rules covering ePHI to vendors and other business associates and to make sure that data is protected at all times. The Office for Civil Rights can issue financial penalties for any HIPAA violations committed and UMHS could be held liable for the breach if it is discovered that HIPAA privacy and security rules have been violated.
