MA-Based Medical Practice Loses Backup Drive With PHI of Nearly 9,400 Patients

Protecting healthcare related information is serious business. Recently, a Massachusetts-based medical practice discovered that a portable backup drive used to store information on patients’ bone density scans was missing. It just seems to have vanished without a trace. On the drive was Protected Health Information, or PHI that is protected under the Health Insurance Portability and Accountability Act (HIPAA). That included x-ray images, names, patient identification numbers, and birthdates. Not included was social security numbers or payment information. However, that doesn’t mean steps should not be taken to protect yourself, if you are a patient of Charles River Medical Associates.

Any patient who had a bone density scan between 2010 and October of 2017 may have been a victim. The number disclosed to the U.S. Department of Health and Human Services was 9,387 patients. It’s important to review all healthcare benefit statements going forward. If there is anything on them that doesn’t look familiar, give your provider a call and try to clear it up. If you discover fraud did take place, contact your health insurance company and report it. Monitoring these benefit statements is always a good idea, whether you were notified that you were a recent victim of healthcare fraud or not. It can happen at any time, even when it seems as if it’s out of the blue.

PHI or ePHI (for electronic records) includes all identifiable health information of an individual. This can include medial history, test results, demographic information, insurance information, and any other information that is used by healthcare and insurance professionals to identify and care for a patient.

HIPPA requires that any entity covered by it implement safeguards that ensure this information will remain confidential. This means any information stored on drives should be encrypted using current, strong encryption technology. Charles River Medical Associates is now doing this. It also performed a full security review, a hardware review, and trained staff on privacy workflows. While this is valuable and necessary, organizations should always take a proactive approach to securing data and hardware.

As soon as it was known that the backup drive had gone missing, a thorough search was conducted. Staff members were questioned as well, but it was not found. The company does not believe it was stolen, but still cannot rule out the possibility that unauthorized parties viewed the data.