Children's Hospital Reports Second Data Breach

Legal Article

Children's Hospital Reports Second Data Breach

Children’s National Hospital has – again – been the subject of a data breach of personal health information as reported by the Washington Business Journal.

In a notice sent to patient families, the D.C. health system said the issue arose with Centreville-based Ascend Healthcare Systems. Ascend provided medical transcription services to Children’s National from May 1 until June 23, 2014, when Children’s ceased doing business with them.

The breach apparently stems from a third party company named “Ascend” which “inadvertently placed those files on a file transfer protocol (or FTP) site that was configured in a way that allowed access to the transcription documents from the Web.”

Under the HIPAA Privacy Rule, covered entities (such as Children’s National Hospital) are responsible for the privacy and security failures of these third parties, called “business associates.”

The documents breached include patient names, birth dates, medications and physician notes regarding diagnoses and treatments. However, the documents did not include billing or financial information such as credit card numbers, Social Security numbers or banking information.

This breach comes a little more than a year after Children’s Hospital announced a breach that involved the loss of personal health information and financial information, including social security numbers. The first data breach involved over 18,000 patient documents. Approximately 4,000 patient families have received notice of this latest breach. Data breaches involving healthcare systems puts clients in a difficult position as they may feel that they are forced to choose between receiving good healthcare that is close to their house and covered under their insurance and having their private information exposed. This situation is obviously much different from when a data breach occurs in a company that focuses on consumer’s goods that can easily be left out of people’s lives. For more information regarding what to do if you were part of this data breach, schedule a consultation with one of our attorneys.