Stanford reports fifth big HIPAA breach
Stolen laptop at children's hospital compromises PHI of 13,000
Officials at Stanford University's Lucile Packard Children's Hospital are notifying nearly 13,000 patients that their protected health information has been compromised following the theft of a hospital laptop.
An employee notified the hospital May 8 that an unencrypted laptop containing medical information on pediatric patients had been stolen from a badge-access controlled area of the hospital. Officials say the laptop contained patient names, ages, medical record numbers, surgical procedures, names of physicians involved in the procedures and telephone numbers.
This is the fifth big HIPPA breach for Stanford University.
Following Stanford's most recent HIPAA breach in January, hospital officials said they were "redoubling efforts to ensure that all computers and devices containing medical information are encrypted."
Robert Dicks, spokesperson for Lucile Packard, said hospital officials have taken steps to prevent another HIPAA breach from happening in the future. He cited new HIPAA training and enhanced IT security and compliance education.
"It is important to reiterate that in the recently reported breach at Packard Children's Hospital, the stolen device was an older, non-functioning laptop with a seriously damaged screen," he explained in an emailed statement to Healthcare IT News. "The employee had already begun using a newer, non-damaged laptop that was encrypted."
Diane Meyer is the chief compliance and privacy officer at Stanford Hospital & Clinics and Lucile Packard, and Ed Kopetsky was hired in 2009 as the hospital's chief information officer.
[See also: Stanford reports fourth HIPAA breach.]
Just in January, the Palo Alto, Calif.-based Lucile Packard Children's Hospital notified some 57,000 patients of HIPAA-breach after an unencrypted company laptop containing patient medical information was stolen from a physician's car.
In 2010, The New York Times reported Stanford Hospital & Clinics notified nearly 20,000 patients that their protected health information had been wrongfully posted to a student website, which resulted in a class action lawsuit filed for $20 million.
Later in July 2012, Stanford University Medical Center notified 2,500 patients of a HIPAA-breach after an unencrypted computer was stolen from a physician's office, according to HHS.
Moreover, in January of 2010, Lucile Packard Children's Hospital reported a breach involving more than 500 patients after an employee stole a hospital computer. The hospital failed to report the breach within the five-day timeframe established by the state and eventually was slapped with a fine.
[See also: 10 largest HIPAA breaches of 2012.]
The hospital is offering a year of identity theft protection to affected families that wish to have it.
Topics:
Privacy & Security
