Potential PHI Compromise May Have Impacted 582,000 Patients of California Dept. of Developmental Services

by | Apr 24, 2018

582,174 patients of the California Department of Developmental Services (DDS) is contacting customers to inform them that their protected health information has possibly been compromised.

Last February 11, 2018, some people broke into the DDS legal and audits offices in Sacramento, CA. After they broke in the thieves potentially had access to the sensitive information of around 15,000 employees, contractors, job applicants, and parents of minors who are treated by DDS services, along with to the PHI of more than half 500,000. The thieves also got away 12 government computers.

It is not yet clear if the perpetrators were interested in paper records and all computers taken by the thieves were encrypted so data access was not possible. DDS has approved that none of the office computers were used to gain access to the department’s network and electronic protected health information remained safe at all times.

In the substitute breach notice posted, DDS made reference to the fact that its offices were vandalized and a fire was placed, which triggered the sprinkler system inflicting damage to documents and CDs.

The manner of the vandalism and the damage caused by the fire and sprinkler system has made it impossible to deduce with 100% certainty whether any information was removed from the offices or if PHI has been compromised.

If PHI was seen or stolen it would have been restricted to names, medical records, unique state-issued client identifier details, service codes, service dates, units billed, and amounts paid for services.

Law enforcement agencies have been made aware of the incident and the burglary has been reviewed but the perpetrators have not been found.

While it is not thought that the thieves gained access to the protected health information of patients, notifications have been sent to affected persons out of an abundance of caution and the incident has been reported to the Department of Health and Human Services’ Office for Civil Rights (OCR).

The HIPAA security breach is the most recent to be submitted to the OCR in 2018, surpassing the 279,865 -record breach at Oklahoma State University Center for Health Sciences that was submitted in January and the 134,512-record violation at St. Peter’s Surgery & Endoscopy Center, reported in February 2018.

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.


Please enable JavaScript in your browser to complete this form.

Patrick Kennedy

Patrick Kennedy is a highly accomplished journalist and editor with nearly two decades of experience in the field. With expertise in writing and editing content, Patrick has made significant contributions to various publications and organizations. Over the course of his career, Patrick has successfully managed teams of writers, overseeing the production of high-quality content and ensuring its adherence to professional standards. His exceptional leadership skills, combined with his deep understanding of journalistic principles, have allowed him to create cohesive and engaging narratives that resonate with readers. A notable area of specialization for Patrick lies in compliance, particularly in relation to HIPAA (Health Insurance Portability and Accountability Act). He has authored numerous articles delving into the complexities of compliance and its implications for various industries. Patrick's comprehensive understanding of HIPAA regulations has positioned him as a go-to expert, sought after for his insights and expertise in this field. Patrick's bachelors degree is from the University of Limerick and his master's degree in journalism is from Dublin City University. You can contact Patrick through his LinkedIn profile:

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.

Comprehensive HIPAA Training

Used in 1000+ Healthcare Organizations and 100+ Universities

    Full Course - Immediate Access

    Privacy Policy