Lucile Salter Packard Children’s Hospital at Stanford University has been fined $250,000 by California health officials for failing to report a breach of 532 patient medical records within 5 days of an apparent theft of a hospital computer by an employee.

The penalty imposed on the hospital is the maximum allowed amount, a spokesman for the California Department of Public Health, Ralph Montano said. He also added, “The penalty is assessed at the rate of $100 for every day of delayed reporting after the first five days for each patient medical record that was breached.”

State officials released a document on Thursday, called “2567,” summarizing the results of the state’s investigation of the Lucile Packard computer theft. It said an unauthorized hospital employee and her husband, another employee, were observed on January 5 in the hospital’s Heart Center removing a computer that contained protected health information on 532 patients.

State officials added, “Based on interviews and record review, the hospital failed to notify a privacy breach of patients’ protected health information (PHI) to 532 patients within five days after the hospital confirmed the breach on 2/1/10. The hospital failed to send notifications to the patients until 2/19/10.”

“The confidential data included names, date of birth, medical record numbers, diagnoses, procedures, insurance information and/or social security numbers.”

On Thursday, Lucile Packard officials posted a lengthy statement on their website stating that they intend to appeal against the $250,000 fine.

“The computer in question was used by an employee whose job required access to patient information,” the hospital said.

“Even though the employee had signed written commitments to keep patient information confidential and secure in accordance with legal requirements and hospital policies, the hospital received reports that the now-former employee allegedly removed the computer from hospital premises and took it home.”

“The hospital immediately began a thorough investigation and also reported the matter to law enforcement in an attempt to recover the computer quickly. As soon as the hospital and law enforcement determined the computer was not recoverable, the hospital voluntarily reported the incident to the California Department of Public Health (CDPH) and federal authorities, as well as the families of potentially-affected patients. The hospital also provided to the families identity theft protection and other support services.”

“Theft charges have been filed against the former employee.”

Spokesman for Lucile Packard, Robert Dicks forwarded this statement from Susan Flanagan, RN, chief operating officer: “This theft was very unfortunate. We hold ourselves to the highest standards in taking care of the children we treat, and we are committed to providing the best care possible and to protecting our children’s privacy.”

“The incident in question was related to the apparent theft earlier in the year of a password-protected desktop computer that contained information about 532 patients. The hospital immediately began a thorough investigation and also reported the matter to law enforcement in an attempt to recover the computer quickly.”

“As soon as the hospital and law enforcement determined the computer was not currently recoverable, the hospital reported the incident to the CDPH and federal authorities, as well as the families of potentially-affected patients.”

“The privacy and security safeguards we employ are some of the most advanced technologies and controls available to hospitals today.”

Ed Kopetsky, chief information officer at Packard Children’s added, “Even though the investigation revealed that no patients were harmed and apparently no patient information was compromised, we are using this incident to further tighten our security and provide additional education to our staff.”

Moreover, Dicks added a date has not been set for the ruling on the appeal.

How Alertsec Xpress Would Have Helped

If you use a data security software a theft would simply be reduced to an insurance matter and cost of the hardware plus time to rebuild the computer. That is certainly a small price to pay compared to what can happen if you lose confidential or sensitive data. Alertsec Xpress offers a very good and easy-to-use laptop security service that includes more than the traditional software licensing model. Feel free to subscribe for your personal 30-day free trial.

Related articles by Zemanta

• Google Health Gets More Useful, More Personalized (webpronews.com)
• Accenture Inks Health IT Deal With Stanford (informationweek.com)