HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Vendor Error Places Mind Springs Health Patients’ PHI in Search Engines

Earlier this month, Virtua Medical Group announced a data breach that resulted from an error made by a transcription service vendor. The protected health information (PHI) of 1,654 patients could be accessed via the Internet and data had been indexed by search engines. It would appear that Virtua was not the only company to be affected by the server configuration error made by its business associate.

Mind Springs Health, a Colorado-based provider of mental health and substance abuse services, appears to also have been affected. 2,147 patients have now been notified that their PHI has been exposed as a result of a server misconfiguration error made by an unnamed transcription service provider.

As was the case with the Virtua Medical Group data breach, the incident occurred in early January. The substitute breach notice placed on the Mind Springs Health website does not mention when the error occurred, only that it was discovered on January 8, 2016.

Highly sensitive data such as Social Security numbers, financial information, credit card numbers, and insurance details were not exposed as a result of the error, although patients affected had their name, date of birth, medication details, and physician notes exposed. According to the breach notice, the vendor “not taken proper security and privacy measures.”

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

The data were only accessible for a short period of time, but during that time they could be accessed via search engines, including Google. Mind Springs Health has not been informed of any inappropriate use of the data at this point in time. It is unclear whether the data were actually viewed by any unauthorized individuals during the time they were accessible.

As soon as the error was discovered steps were taken to secure the data to prevent unauthorized access and PHI is no longer accessible via the Internet. Mind Springs Health has also implemented a number of controls to prevent similar privacy breaches from occurring in the future, one of which being changing its transcription service provider.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.