Legal Aid Society of San Mateo CA Suffers Data Breach Including Health Info

On October 10, 2013, the Legal Aid Society of San Mateo County, California sent out a letter notifying potential victims of a data breach suffered by the Society. As the letter states,

On the night of August 12, 2013, our office was burglarized and ten of our laptops were stolen. The stolen laptops were used by our attorneys to assist individuals in getting services. We believe that your personal information may have been stored on the stolen laptops. The personal information believed to be stored on the stolen laptops includes your name, Social Security number, date of birth, medical and health information.

What makes this data breach particularly noteworthy is that, although it occurred at a legal aid organization, the information stolen reportedly included health information. The notice does not discuss how and why health information might have been collected and stored by LASSMC; it may relate to the Society's health advocacy services.

Beyond the immediate impact on the LASSMC clients and others whose stolen personal information may be misused, this incident serves as a reminder that even non-medical professionals may hold, and must keep safe, health information. Even where the formal privacy and security requirements of HIPAA may not directly apply, organizations may still need to comply with HIPAA's Business Associates rules as well as general consumer protection obligations. Attorneys in particular should be aware not only of these requirements, but of their ethical obligations to keep client information confidential, which may further be relevant in a data breach situation.

The California Attorney General's list of reported data breaches may be found here; the LACSSMC letter and information is at this link.

$50,000 HIPAA Security Violation Settlement Announced by HHS OCR

On January 2, 2013, the Office of Civil Rights of the U.S. Department of Health and Human Services ("OCR") announced its first-ever settlement of a health privacy violation case involving information from fewer than 500 individuals. According to OCR, the Hospice of North Idaho will pay $50,000 to settle the case brought under the Security Rule of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA").

According to the OCR's press release,

The HHS Office for Civil Rights (OCR) began its investigation after HONI reported to HHS that an unencrypted laptop computer containing the electronic protected health information (ePHI) of 441 patients had been stolen in June 2010. Laptops containing ePHI are regularly used by the organization as part of their field work. Over the course of the investigation, OCR discovered that HONI had not conducted a risk analysis to safeguard ePHI. Further, HONI did not have in place policies or procedures to address mobile device security as required by the HIPAA Security Rule. Since the June 2010 theft, HONI has taken extensive additional steps to improve their HIPAA Privacy and Security compliance program.

“This action sends a strong message to the health care industry that, regardless of size, covered entities must take action and will be held accountable for safeguarding their patients’ health information.” said OCR Director Leon Rodriguez. “Encryption is an easy method for making lost information unusable, unreadable and undecipherable.”

The Health Information Technology for Economic and Clinical Health (HITECH) Breach Notification Rule requires covered entities to report an impermissible use or disclosure of protected health information, or a “breach,” of 500 individuals or more to the Secretary of HHS and the media within 60 days after the discovery of the breach. Smaller breaches affecting less than 500 individuals must be reported to the Secretary on an annual basis. 

The release also discussed a new joint educational effort by OCR and the HHS Office of the National Coordinator for Health Information Technology entitled Mobile Devices: Know the RISKS. Take the STEPS. PROTECT and SECURE Health Information.

The resolution agreement for the Hospice of North Idaho case can be read here. For more information on both the HIPAA Privacy Rule and HIPAA Security Rule, visit HHS' main HIPAA page. OCR also offers an e-mail distribution list for its privacy-related activities, OCR-PRIVACY-List, available via this link.

HIPAA De-Identification Guidance from HHS OCR

The Office of Civil Rights ("OCR") of the U.S. Department of Health and Human Services recently issued guidance for appropriate ways to de-identify (remove personally identifiable information from) electronically stored health records. De-identification is required by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") Privacy Rule in order to permit scientific analyses and other publicly beneficial uses of health records without violating the privacy of the patients whose health information is being shared for analysis. Section 164.514(b) of the HIPAA privacy rule provides two methods for de-identification: Expert Determination and the so-called "Safe Harbor."

It can be challenging, though, to completely de-identify any health information, since those with other sources of information may be able to combine those databases with the de-identified data to "re-identify" individual patients. (In a non-health context, this was demonstrated in 2006 after AOL released a supposedly anonymized search query database of its users, and reporters were able to positively identify at least one user by her particular searches.) With its latest guidance (which can be downloaded here), OCR answers questions about the use and limitations of its approved de-identification methods.

(via IAPP)