NM Radiology Practice Health Data Breach Results in PHI Exposure

Improper PHI Disposal Creates Patient Privacy Concerns at NJ Hospital

The Valley Hospital announced it has begun notifying individuals of an accidental patient privacy event that involved improper PHI disposal.

On August 29, 2022, the New Jersey-based hospital discovered that some “Post-COVID-19 Testing Patient Instructions” were accidentally disposed of in a recycling bin at an outpatient COVID-19 testing facility.

After learning of the event, an investigation was promptly launched, according to a notice on the hospital website. The Valley Hospital also attempted to retrieve the improperly disposed instruction, but its efforts were unsuccessful.

“Through its investigation, The Valley Hospital determined that the Instructions included the names of the providers administering the COVID-19 test, and label with the patient names, medical record numbers, service dates, and location codes for the patients’ scheduled procedure,” the hospital stated.

“The Instructions DID NOT include patient addresses, phone numbers, insurance identification numbers, Social Security numbers, positive or negative status, procedure type, or any other information that constitutes protected health information.”

The Valley hospital said it has no evidence that any patient PHI was acquired or misused. However, out of an abundance of caution, all patients tested at that facility between June 1, 2022, and September 1, 2022, will notify all patients.

“Based on the limited nature of the information involved, patients tested at that facility are unlikely to be at risk of identity theft or data misuse, and no further action on their part is needed,” the hospital stated.

Health Insurance Agency Suffers Data Security Incident, Over 8K Impacted

CareOregon became aware of a data security incident that exposed PHI for over 8,000 current members of the health insurance agency.

On August 9, 2022, marketing letters containing members’ PHI, including name and Medicaid ID number, were sent out to the wrong address, a website notice stated.

Upon learning of the incident, CareOregon began notifying impacted individuals of the incident. Additionally, the health insurance agency conducted an investigation that concluded this incident poses a low risk of fraud and identity theft.

“The investigation confirmed that the organization has the correct policies and procedures in place to address this type of breach and those processes are reviewed yearly,” CareOregon wrote in the website notice. “We’ve provided additional training to the employee to make sure this doesn’t happen again.”

CareOregon encouraged members who are concerned about the breach to review account statements and credit reports.