Human error cause of Calif. children’s hospital breach

Human error was the cause of two breaches at Rady Children’s Hospital-San Diego.

An employee of the hospital inadvertently emailed four job applicants a spreadsheet containing identifiable information of 14,121 patients admitted to Rady’s Hospital between July 1, 2012 and June 30, 2013. The individual had intended to send a training file to evaluate the applicants, but instead attached elements of actual patient information by mistake, according to a hospital statement.

Information disclosed included: patients’ names, dates of birth, primary diagnoses, admit/discharge dates, medical record numbers and other information including insurance carrier and claim information.

The individuals receiving the email, which included two additional people to whom the correspondence had been forwarded, all have confirmed in writing the removal of the email and attachment. “We have employed an independent IT security firm to verify that the files have been deleted from the recipients’ devices,” according to the hospital.

Following an internal investigation, the hospital uncovered another instance of patient information shared in error. In this case, in August, November and December 2012, an employee emailed a training exercise to three job candiadates that contained limited information of 6,307 patients.

Information included patients’ names, discharge dates, location they were seen and account information such as the payer name and balance.

“We are making every effort to contact the three recipients to confirm that the email and file have been destroyed,” according to the notice.

The hospital is taking a number of steps to prevent future breaches:
• Increasing data security by further automating flagging of emails that may contain potential protected health or other sensitive information, and requiring an added level of approval before they can be sent.
• Working with its email encryption provider to further strengthen protection of sensitive data.
• Using these incidents as examples to better inform the leadership team and employees about privacy and security risks.