Security Breach Notification

Within the last week, The Boston Globe has reported that venerable Boston Children’s Hospital, the primary pediatric teaching hospital of Harvard Medical School, has notified the public media and affected individuals of a large PHI security breach that occurred in Buenos Aires, Argentina.
Continue Reading Boston Children’s Hospital: Reported Large PHI Security Breach in Argentina Gives the Parade a New International Flavor

On March 30, 2012, a large data security breach, which has not yet been posted on the U.S. Department of Health and Human Services list of breaches of unsecured PHI, was experienced by the Utah Department of Technology Services on a computer server that stores Medicaid and Children’s Health Insurance Program claims data.
Continue Reading Utah Department of Health: A Bold Repeat Marcher in the Parade of Major PHI Security Breaches

On February 24, 2012, HHS posted number 400 on its ever-lengthening list of breaches of unsecured PHI affecting 500 or more individuals. Theft of laptops is a recurrent source of such breaches, and the 400th breach was such an incident affecting Triumph, LLC in North Carolina.
Continue Reading The Parade of Major Reported PHI Breaches Hits 400 – A Closer Look at Victim 400 and its Actions in Response to the Breach – Part 2

UCLA has developed a mixed record of disclosure with respect to its most recent security breach of PHI that was reported as a theft of an other portable electronic device on September 7, 2011.
Continue Reading The Parade of PHI Security Breaches: UCLA Rejoins the March and Merits Mixed Reviews for the Quality of its Public Disclosures

Five members of Congress are co-signers of a bipartisan letter dated December 2, 2011, addressed to the Director of the TRICARE Management Authority to express the Congress members’ “deep concerns about a major breach of personally identifiable and protected health information by TRICARE contractor Science Applications International Corporation (SAIC).”
Continue Reading Congressional Inquiry or Autopsy for SAIC Breach Disaster? – Part 5

The recent MedPage Today survey results as to “third party errors” mirrors to some extent the proportion of business associate involvement reported for incidents that involved higher numbers of individuals on the HHS list of large PHI breaches as of December 2, 2011.
Continue Reading The Silent Brigade in the Parade of Major Reported PHI Breaches of Security and Privacy: Business Associates – An Update

Given earlier assurances to the “approximately 4.9 million patients treated at military hospitals and clinics during the past 20 years” that the risk of harm was low from the SAIC PHI breach and there was no conclusive evidence that patients were at risk of identity theft, one can speculate as to whether Tricare/DoD’s abrupt about-face as to offering credit monitoring and restoration services relates to new evidence, a revised judgment as to the risk of harm to affected patients and/or simply an abundance of caution as to its own exposure to risk.
Continue Reading Did Tricare/DoD Make a “Proactive Response” or a Preemptive Strike with SAIC in the PHI Breach Matter? Whose Risk is it Anyway? – Part 4

When is the mere “ability” to read protected health information (“PHI”), without evidence that the PHI was actually read or was likely to have been read, enough to trigger the notice requirement under the Breach Notification Rule? Recent PHI security breaches, including that being confronted by the Department of Defense and SAIC, Inc. will provide some information and guidance.
Continue Reading SAIC and Its Military Millions March – Flooding the Parade with Possible PHI Breaches – Part 3