Health Agency Reports Data Breach Affecting 2,550 People
The California Department of Public Health has lost a magnetic tape containing medical records and other personal data on 2,550 employees and residents of health care facilities, officials said in a statement Wednesday, the Los Angeles Times' "L.A. Now" reports.
Background on Breach
DPH employees sent the magnetic tape though U.S. mail from a West Covina office to the department's central office in Sacramento for backup.
On Sept. 27, the envelope that had contained the tape arrived unsealed and empty. DPH immediately reported the data breach and began an investigation (Hennessy-Fiske, "L.A. Now," Los Angeles Times, 12/15).
Kevin Reilly, chief deputy director for policy and programs at DPH, said the breach resulted from a violation of protocol.
Protocol calls for the state to use a private courier instead of the U.S. Postal Service to send sensitive material. DPH's West Covina office did not consistently follow that policy, Reilly said (Clark, HealthLeaders Media, 12/16).
The magnetic tape contained such data as:
- Social Security numbers of department staff, health care workers and facility residents;
- Confidential department e-mails;
- Background information on health care workers;
- Investigative reports; and
- Names of health care facility residents and their diagnoses ("L.A. Now," Los Angeles Times, 12/15).Â Â Â Â Â Â Â Â Â
Officials said the incident likely was an accident and they do not suspect foul play (Palma Markus, San Gabriel Valley Tribune, 12/15).
They also said the data were encrypted using a system that would be difficult for a non-state employee to decode (HealthLeaders Media, 12/16).
Follow Up Action
According to Reilly, the employees who improperly mailed the package have faced disciplinary action and have undergone additional training (Palma Markus, San Gabriel Valley Tribune, 12/15).
As of this week, state regulators still were notifying individuals who might have been affected by the data breach and advising them about how to protect themselves from identity theft.
DPH said it has not received any reports of identity theft related to the lost tape ("L.A. Now," Los Angeles Times, 12/15).
For additional coverage of DPH's security incident, see today's Capitol Desk post.This is part of the California Healthline Daily Edition, a summary of health policy coverage from major news organizations. Sign up for an email subscription.