Paper Records Missing from Storage Facility According to Illinois Physicians Network

Many data breaches have been reported by HIPAA-covered entities, involving the loss or theft of physical records, in the past two months. In November, seven violations  involving paper records were made known to the HHS’ Office for Civil Rights, and another five incidents were made known the month prior to that.

Now another incident has been submitted in Illinois. Franciscan Physician Network of Illinois and Specialty Physicians of Illinois LLC have found that payment records that were kept in a storage center are missing. The storage center in Chicago Heights was used by both physician groups.

The loss/theft of the paper files is one of the largest violations of the past few months, potentially affecting as many as 22,000 people. The payment records were from the time period(s) 2015-2017 and 2010.

The boxes of paper files were confirmed as missing from their location on November 21, 2017, with notifications sent on December 13, 2017. The loss of files was found following a routine records request, but the records could not be found. An inventory of the storage facility was completed, and 40 boxes of files were seen to be missing and potentially stolen.

The records only included a small amount of patient information related to payments received, and included names and addresses, types of payment, payment amounts, office location, and the last four digits of credit card details. For a small number of patients who settled their bill by check, their routing number, bank account number and Social Security number were also included in the files.

A number of the records from 2010 may also have included insurance ID details, facility-assigned account details, dates of birth, type of visit, diagnoses, provider names and addresses, dates attended, descriptions of services provided, and procedure codes.

While the files may have been stolen, foul play is not suspected in this instance. As a precautionary measure, those impacted by the incident have been offered the chance to avail of two years of identity theft protection services for free.