Health Care Records Stolen at the University of Kentucky

JMcDaniel - 08/25/2010

---

Health Data Management is reporting a disturbing security breach at the University of Kentucky: a laptop computer containing medical records for more than 2000 individuals was stolen from a locked room. The theft occurred in June, and so far there is no evidence that the records have been used for nefarious purposes - or even that the records have been accessed - but the fact remains that names, medical records, and in some cases Social Security numbers have been stolen.

Preventing patient data breaches is the number one priority for healthcare IT workers. A vast majority of hospitals are spending more money on security in 2010 than they did in 2009 in order to comply with HIPAA and HITECH regulations.

The decision to put the Protected Health Information on a laptop computer and the failure to encrypt the laptop will inevitably cost the University of Kentucky hundreds of thousands of dollars in HIPAA fines, in addition to the costs of offering credit and identity protection to the individuals whose personal information was stolen. This once again emphasizes the importance of investing in strong HIPAA compliance processes, policies and training. A relatively small expense early on can help avoid the much larger risks in the future.

We'd love to know what others think about this. How concerned are you about data breaches in this environment? What kind of steps has your organization taken to be prepared?