Accidental Exposure Of Patient Data Leaves Us Shaking Our Heads

Just when we think accidental exposure of sensitive information due human error cannot get any more bizarre, we hear a story from Texas. Yes, the Lone Star state has recently provided us with a story of mystery, intrigue, and complete carelessness too. It started when a Houston woman was fired from her job with the Texas Health and Human Services Commission (HHSC).

The woman was terminated and her former employer considerately mailed her two boxes containing her personal belongings. One of them contained the typical stuff you’d see in your desk; pens, coffee cup, and of course some old shoes. Who doesn’t have an extra pair of old shoes in their desk drawer? However, that box is not at issue. It’s the second box that is concerning. Yes, it too was left unattended on the porch of her home. Normally, this isn’t thought to be a problem. However, this box contained paperwork. It was indeed paperwork that one may find in a desk of an employee of the Texas HHSC (or any other similar organization), but it was also information on approximately 100 people including driver’s licenses, check stubs, social security numbers, and billing statements. And even more strange is that documents were dated 15 days after the woman had been terminated.

Yes, you read that correctly. The documents were sent to her more than two weeks after she was fired. Not only did she not have any business having the information after her departure, even if she had worked on the files before, in this case she was never meant to see them. Yet, they showed up on her porch and were left unattended.

It is very important that anyone dealing with sensitive information, whether it is healthcare, financial, or anything else that it’s handled with the utmost care. Things like this should never be sent offsite once an employee is no longer with the organization, and possibly not at all. In fact, it not only could be a violation of company policy, but could also be a violation of HIPAA or other regulations regarding sensitive information, regardless of the situation. Check with your management to find out the policies and regulations in your specific case. HIPAA violation fines can be significant for the organization and may cost someone his or her job too.

Ironically, the reason the woman was fired was allegedly because she failed to protect client information and violated HIPAA rules. She did seek assistance to find out what to do about the documents. The HHSC is also investigating and the incident was reported to the Office of Inspector General.