The Minneapolis Star Tribune reports that a laptop computer containing private information on about 14,000 patients of Fairview Health Services and 2,800 patients of North Memorial Medical Center was stolen from a locked car in the parking lot of a Minneapolis restaurant in July of 2011. The incident is just one more in a series of recent data breaches around the country, often involving laptops. As we described here, the U.S. Department of Health and Human Services has noted that these types of breaches are increasing in the midst of a massive transition to electronic medical records by health care providers around the country. Both Fairview and North Memorial are sending letters to the affected patients offering free services to protect against identity theft.
The laptop in question belonged to an employee of an outside health care consultant. The computer was password-protected, but the data was not encrypted. Officials contacted for the story stated that, although it is unusual for consultants to keep large amounts of patient data on their laptops, in this case it was justified. Others disagree. Jeff Neuberger of Mid Dakota Clinic in Fargo, North Dakota stated that when an outside contractor needs access to patient information he should be brought on-site and provided temporary, restricted access to the company’s computer system. Either way, it is critically important from a HIPAA and state law compliance standpoint that, when dealing with vendors, the appropriate business associate agreement or other form of confidentiality agreement be in place.
Fairview disclosed another breach of patient data back in April when it lost a box of paper records containing information on 1,200 patients. The box was never recovered, which goes to show that data breaches can still occur the old-fashioned way.