Cook County Health and Hospitals System has recently alerted patients to a breach of their protected health information (PHI). The organisation consists of a health system comprising two hospitals and more than a dozen community health centers in Cook County Illinois, and services many patients.
The breach occurred at Experian Health, a business associate of Cook County Health and Hospitals System. Experian Health is contracted to determine insurance eligibility. Therefore, the minimum amount of patient information is disclosed to the business associate for them to successfully complete their job. This mitigates the potential negative impact in the instance of a breach occurring.
The breach occurred in March 2017 during an upgrade of Experian Health’s computer system. The protected health information of 727 patients was accidentally sent to other healthcare systems. The PHI disclosed was limited and it has been confirmed that it did not include personal identifiers. This type of information is sought by cybercriminals to commit identity theft, and therefore there is thought to be little risk to the patient’s personal security.
Due to the limited disclosure of PHI, and the fact that the information was sent to other healthcare organizations who are also covered by HIPAA Rules, the risk to patients is believed to be low. To date, Experian Health has not been notified of any unauthorized uses of the disclosed information. The breach was limited to patients’ names, medical record numbers, dates of birth, and account numbers.
Following discovery of the breach, Experian Health took steps to recover and secure the disclosed information, in accordance with the HIPAA Breach Notification Rule. They have also taken steps to implement security measures to prevent similar incidents from exposing the PHI of patients. Cook County Health and Hospitals System also reviewed the breach and is satisfied with the actions taken by Experian Health to prevent similar breaches from occurring in the future.
Cook County Health and Hospitals System was notified of the breach on August 1, 2017 and a substitute breach notice was posed on the health system’s website on October 2, 2017. All patients impacted by the breach have now been notified by mail and a breach report has been submitted to the Department of Health and Human Services’ Office for Civil Rights.