On Oct. 31, the hospital learned an employee removed a computer hard drive from the hospital, in violation of its policy. That employee, who no longer works at Chilton, sold the hard drive on the internet earlier that month.
Chilton launched an investigation into the incident, which determined the hard drive contained patient information that may have included patients’ names, dates of birth, addresses, medical record numbers, allergies, and medications the patient may have received at the hospital. However, no Social Security numbers, financial information or medical records were affected.
The investigation also revealed the former employee removed other devices and assets from Chilton to sell on the internet. While hospital officials do not believe these devices or assets contain patient information, they will continue to investigate the incident and, if it is determined additional patients were affected, will notify them as appropriate.
“While we have policies in place to protect patient information, we have, since this incident, enhanced our processes and controls to help prevent something like this from happening again,” reads a notice on the organization’s website.
Becker’s Hospital Review has reached out to Chilton Medical Center for comment. This story will be updated as more information becomes available.
More articles on cybersecurity:
Representative introduces legislation to allow EHR clearinghouses work directly with patients
AMIA, Pew to Congress: Secure funding for the EHR reporting program
10 EHR implementations with the biggest price tags in 2017
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.