Colorado patients mailed protected health data; investigation under way
Boulder Community Hospital (BCH) in Colorado has been contacted by patients of Lafayette, Colo.-based Family Medical Associates (FMA), who were mailed copies of their own protected health information by an anonymous source. An accompanying letter claims that the information was stolen from Community Medical Center’s recycling bins, according to BCH.
FMA is a hospital-owned primary care practice in Community Medical Center, one of the major facilities of BCH.
Thus far, "only patients of FMA who were seen at the clinic last October have been affected,” reported the hospital. BCH, which experienced a total 464,722 outpatient visits in 2008, has contacted the Lafayette Police to help investigate the incident to determine when the patient information was stolen. BCH also notified the federal Office of Civil Rights about the theft.
“Our investigation will help us identify any other patients whose personal information may have been compromised,” reported the hospital. BCH stated that it plans to contact those patients via letter.
To improve the security of the CMC recycling system, BCH said upgraded storage bins that are self-locking have been installed and everyone involved in the recycling process is being re-educated to ensure awareness of the hospital’s policies in this area. The hospital management team will conduct spot checks of the recycling system to ensure that policies are being followed, BCH said. The requirement that documents with protected health information must be kept secure will be reinforced.
According to the hospital, because the theft may have exposed affected patients to an increased potential for identity theft, BCH has hired risk-consulting company Kroll to work with patients to determine if and to what extent their information has actually been misused.
“If a patient becomes a victim of identity theft as a result of this incident, Kroll’s licensed investigators will work on their behalf to restore their name to pre-theft status, without financial loss for the patients,” the hospital said.
“We are moving as quickly as we can, but this is a complicated issue. We don’t have a definitive date for completing the investigation,” stated the hospital.
Concerned patients can call 720-854-7373.
FMA is a hospital-owned primary care practice in Community Medical Center, one of the major facilities of BCH.
Thus far, "only patients of FMA who were seen at the clinic last October have been affected,” reported the hospital. BCH, which experienced a total 464,722 outpatient visits in 2008, has contacted the Lafayette Police to help investigate the incident to determine when the patient information was stolen. BCH also notified the federal Office of Civil Rights about the theft.
“Our investigation will help us identify any other patients whose personal information may have been compromised,” reported the hospital. BCH stated that it plans to contact those patients via letter.
To improve the security of the CMC recycling system, BCH said upgraded storage bins that are self-locking have been installed and everyone involved in the recycling process is being re-educated to ensure awareness of the hospital’s policies in this area. The hospital management team will conduct spot checks of the recycling system to ensure that policies are being followed, BCH said. The requirement that documents with protected health information must be kept secure will be reinforced.
According to the hospital, because the theft may have exposed affected patients to an increased potential for identity theft, BCH has hired risk-consulting company Kroll to work with patients to determine if and to what extent their information has actually been misused.
“If a patient becomes a victim of identity theft as a result of this incident, Kroll’s licensed investigators will work on their behalf to restore their name to pre-theft status, without financial loss for the patients,” the hospital said.
“We are moving as quickly as we can, but this is a complicated issue. We don’t have a definitive date for completing the investigation,” stated the hospital.
Concerned patients can call 720-854-7373.