Vendor Error Places Mind Springs Health Patients’ PHI in Search Engines
Earlier this month, Virtua Medical Group announced a data breach that resulted from an error made by a transcription service vendor. The protected health information (PHI) of 1,654 patients could be accessed via the Internet and data had been indexed by search engines. It would appear that Virtua was not the only company to be affected by the server configuration error made by its business associate.
Mind Springs Health, a Colorado-based provider of mental health and substance abuse services, appears to also have been affected. 2,147 patients have now been notified that their PHI has been exposed as a result of a server misconfiguration error made by an unnamed transcription service provider.
As was the case with the Virtua Medical Group data breach, the incident occurred in early January. The substitute breach notice placed on the Mind Springs Health website does not mention when the error occurred, only that it was discovered on January 8, 2016.
Highly sensitive data such as Social Security numbers, financial information, credit card numbers, and insurance details were not exposed as a result of the error, although patients affected had their name, date of birth, medication details, and physician notes exposed. According to the breach notice, the vendor “not taken proper security and privacy measures.”
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The data were only accessible for a short period of time, but during that time they could be accessed via search engines, including Google. Mind Springs Health has not been informed of any inappropriate use of the data at this point in time. It is unclear whether the data were actually viewed by any unauthorized individuals during the time they were accessible.
As soon as the error was discovered steps were taken to secure the data to prevent unauthorized access and PHI is no longer accessible via the Internet. Mind Springs Health has also implemented a number of controls to prevent similar privacy breaches from occurring in the future, one of which being changing its transcription service provider.
