On October 22, 2016, Henry County Health Department was notified that a health department nurse’s laptop computer and some paper records were stolen, potentially exposing the medical records of up to 574 Henry County Health Department Home Health and Hospice patients.
In the early morning of October 22, a health department nurse was the victim of a home invasion, and the burglar stole her car from inside her locked garage. Inside her car, the nurse had a bag with an HCHD laptop and paper records that contained medical information. The nurse had the laptop and records in her possession as part of her duties to visit certain home health and hospice patients at their homes.
After the theft, police were notified and the situation was investigated. While the suspect was soon apprehended and the car was recovered, the nurse’s bag with the laptop and medical records were not found. At this time, we do not know what has become of the laptop and records. However, the investigation revealed that the laptop and records were not the targets of the theft, but rather the unintended cargo of the suspect’s car theft.
What We Are Doing
HCHD has increased security with respect to the laptops that we use and how we handle medical records in the field. While all our laptops utilize a password authentication process we have now encrypted all our laptops to prevent access to laptop files in ways that may circumvent the login process. We have also reviewed and updated our processes and procedures for the handling of laptops and medical records necessary for nurse visitation of patients in their homes.
While we still hope to recover the stolen laptop and records, we must assume that they are lost to unauthorized persons that may access and misuse patient information. The stolen laptop computer contained the following types of unsecured protected health information: names, dates of birth, Social Security numbers, phone numbers, medical diagnoses and codes, medication lists, and medical insurance information.
Patients affected by the theft are being notified of the incident via a letter in the mail. If you do not receive a letter from the health department regarding this incident, you were not affected by this theft.
Henry County Health Department mailed the following letters to affected patients based on type of risk of exposure:
- Notification Letter to Patients Printed on Face Sheet
- Notification Letter to Patients on Printed List
- Notification Letter to Patients on Electronic Medical Record
Although HCHD is not aware of any access or misuse of the private health information by unauthorized persons or parties, patients who receive the notification letter are strongly encouraged to take steps to eliminate or minimize any potential harm that could be caused by the theft. This includes, but is not limited to, obtaining credit reports from one or more of the major credit reporting agencies, and monitoring financial and banking accounts for unauthorized activity.
By law, consumers may request a free copy of their credit report once every 12 months from each of the three major credit reporting agencies (i.e., Equifax, Experian, Trans Union). These agencies have set up a central website that patients can use to order a free credit report. The free report can be requested online at www.annualcreditreport.com, by phone at 1(877) 322-8228, or by mail addressed to: Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348-5281.
As a precautionary measure, the health department is offering a free one-year membership to a credit/identity theft monitoring service to patients potentially affected by this incident. Patients who may be affected will receive a second letter outlining how they can activate this monitoring service to further ensure the security of their private information. Prior to returning the monitoring application, please ensure that all the information requested is filled out. If the application is not completed filled out, SACS will return the application with a request for the additional information.
If you did not receive this second letter and are a potentially affected patient or have questions about the credit/identity theft monitoring service, please contact us toll-free at (844) 593-3292 for further information.
Henry County Health Department apologizes for the stress and worry this situation may cause our patients.
For More Information
Please do not hesitate to contact us toll-free at (844) 593-3292 or firstname.lastname@example.org with any questions about this incident.