FOR IMMEDIATE RELEASE
Contact: 301-443-3593, newsroom@ihs.gov
IHS addresses data breach by contract physician at three facilities
On August 25, 2014, the Indian Health Service (IHS) Bemidji Area determined that a physician employed by a staffing company under contract with the IHS had improperly accessed protected health information from three IHS facilities. The three facilities affected are the Fort Yates Service Unit in the IHS Great Plains Area, the Cass Lake Service Unit in the IHS Bemidji Area, and the Crow Service Unit in the IHS Billings Area.
The data breach included patient names, Social Security numbers, and health information such as diagnoses, prescribed medications, and laboratory results. However, there is no current indication that the information has been used by or disclosed to any unauthorized individuals.
The IHS contract at issue contained the requirement that contractors must protect patient privacy and comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations. Even though these protections were required as a part of the staffing company's contract with IHS, the contract provider improperly accessed these records.
"IHS is very disappointed that this breach occurred given that the staffing company contract included the requirement that contract providers must protect patient privacy and meet HIPAA regulations. We are committed to ensuring the security and integrity of all our patients' personal information and are putting additional protections in place" said Acting IHS Director Dr. Yvette Roubideaux. "Keeping patient information secure is of the utmost importance to us, and we very much regret that this situation occurred."
In accordance with regulations implementing HIPAA, the IHS has notified all persons whose information was improperly accessed. On October 17, 2014, the IHS sent letters by first class mail to the affected patients to notify them of the privacy breach. Affected patients were also provided phone numbers to call the Area HIPAA Coordinators. As a measure of added security, the IHS is offering one year of free credit monitoring and reporting services to these affected patients. Also, to help protect against further breaches, all contract staff serving the affected Areas are being required to sign a Confidentiality Agreement stating that individually identifiable information is to be held in strict confidence.
Additionally, the Area HIPAA Coordinators have completed an investigation and the matter has been referred for appropriate action in accordance with HIPAA and its implementing regulations.
Patients who received the letter and have any questions can contact the following Area HIPAA Coordinators:
- For the Cass Lake Service Unit in the IHS Bemidji Area - Phillip Talamasy at 218-444-0538 or phillip.talamasy@ihs.gov
- For the Fort Yates Service Unit in the IHS Great Plains Area - Heather H. McClane at 605-226-7730 or heather.mcclane@ihs.gov
- For the Crow Service Unit in the IHS Billings Area- Felicia Blackhoop at 406-247-7184 or felicia.blackhoop@ihs.gov
The IHS, an agency in the U.S. Department of Health and Human Services, provides a comprehensive health service delivery system for approximately 2.1 million American Indians and Alaska Natives.
