If you ever lose patient data, make sure your follow-up is as diligent as that of Northwestern Memorial Hospital’s Home Hospice.

The hospice’s Chicago offices were burglarized June 11 and six laptops and tablets were stolen, according to a July 27 press release.

In an unfortunate confluence of circumstances, a software upgrade was in progress at the time, meaning security measures were suspended. As a result, the thieves could have gained access to personal data, including patients’ Social Security numbers, diagnoses, medications, advance directives and payer information.

“We do not believe the personal information stored on these devices was the target of this theft, but we will continue to work closely with the Chicago Police Department to identify the thieves and locate the devices,” the press release states. Notification letters to patients and family members who may have been affected by the breach have been sent.

The hospice is also taking the following additional measures:

  • Offering a credit bureau monitoring service that could help detect potential cases of identity theft early on.
  • Suggesting other action steps to patients and family members, such as keeping a close eye on benefit and bank statements.
  • Setting up a phone line for patients or family members who haven’t been notified but believe they’ve been affected by the breach.
  • Pointing out steps Northwestern Memorial Home Hospice is taking to prevent another breach, such as reviewing its systems to determine how future security failures can be prevented.

The case is also a good reminder that a HIPAA breach isn’t necessarily a result of carelessness by someone on your staff.

So what can you do? Remember that the HHS Office of Civil Rights (OCR) has recently released its HIPAA audit protocols. How about using them for a self-audit of your data security?

Press release: http://www.marketwatch.com/story/statement-regarding-hospice-burglary-and-patient-health-information-breach-2012-07-27

Audit protocols: http://ocrnotifications.hhs.gov/hipaa.html