582,174 patients of the California Department of Developmental Services (DDS) is contacting customers to inform them that their protected health information has possibly been compromised.
Last February 11, 2018, some people broke into the DDS legal and audits offices in Sacramento, CA. After they broke in the thieves potentially had access to the sensitive information of around 15,000 employees, contractors, job applicants, and parents of minors who are treated by DDS services, along with to the PHI of more than half 500,000. The thieves also got away 12 government computers.
It is not yet clear if the perpetrators were interested in paper records and all computers taken by the thieves were encrypted so data access was not possible. DDS has approved that none of the office computers were used to gain access to the department’s network and electronic protected health information remained safe at all times.
In the substitute breach notice posted, DDS made reference to the fact that its offices were vandalized and a fire was placed, which triggered the sprinkler system inflicting damage to documents and CDs.
The manner of the vandalism and the damage caused by the fire and sprinkler system has made it impossible to deduce with 100% certainty whether any information was removed from the offices or if PHI has been compromised.
If PHI was seen or stolen it would have been restricted to names, medical records, unique state-issued client identifier details, service codes, service dates, units billed, and amounts paid for services.
Law enforcement agencies have been made aware of the incident and the burglary has been reviewed but the perpetrators have not been found.
While it is not thought that the thieves gained access to the protected health information of patients, notifications have been sent to affected persons out of an abundance of caution and the incident has been reported to the Department of Health and Human Services’ Office for Civil Rights (OCR).
The HIPAA security breach is the most recent to be submitted to the OCR in 2018, surpassing the 279,865 -record breach at Oklahoma State University Center for Health Sciences that was submitted in January and the 134,512-record violation at St. Peter’s Surgery & Endoscopy Center, reported in February 2018.
