Siemens to FedEx to Lincoln: Oops 130,495 Patient Records Breached by Two Business Associates.
Sending unencrypted PHI through a carrier is a violation of any good privacy and security policies and procedures, and a CE should be managing their BAs better. Periodic risk assessments can lead to an evaluation of your policies and procedures that would reveal these gaps in your security and privacy program.
What is interesting to me is that the hospital says that they are not using FedEx to ship patient records anymore. So does this mean that they are trusting USPS or UPS or have they realized that encryption might be a good idea?
Here is the article from Computerworld:
New York hospital loses data on 130,000 via FedEx
- 30 June, 2010 15:46
The CDs were sent by the hospital's billing processor, Siemens Medical Solutions USA, around March 16, but never arrived at their intended destination. They included sensitive health and personal information including Social Security numbers, addresses, dates of birth, health plan numbers, driver's license numbers and even descriptions of medical procedures, the hospital said on a note posted to its Web site.
The breach affects 130,495 patients, according to a notification posted Tuesday by the U.S. Department of Health and Human Services.
"FedEx has suggested that the CDs likely became separated from their shipping envelope at one of its facilities, were swept up and destroyed," the hospital said in a letter sent to victims, dated June 4.
The CD was password-protected but unencrypted, the letter states.
Companies have begun taking better care of their customers' data in recent years, as they've had to foot multimillion-dollar bills following similar incidents. According to the Ponemon Institute, a security research firm, the average U.S. data breach costs companies more than US$200 per record .
Siemens is no longer FedExing CDs to Lincoln, the hospital said. It is not aware of any of the data being improperly accessed.
Subscribe via RSSCategories
- HIPAA HITECH Act
- HIPAA Covered Entity
- HIPAA Business Associates
- Health Information Privacy
- HIPAA Compliance Online Software
- HIPAA Compliant Checklist
Recent Blog Posts
- Business Associates Need HIPAA HITECH Compliant Policies and Procedures, Now/1
- Minnesota Attorney General Sues Business Associate for HIPAA HITECH Data Breach
- HIPAA HITECH Data Breach Costs Small Business Associate $300,000
- HIPAA HITECH Rules De Facto Standard?
- HIPAA HITECH Data Breach: $1000 Per Patient?
- Senate Hearings Focus on Lack of HIPAA Enforcement, Final HITECH Rule
- more from the blog
