In the first breach, an unencrypted laptop containing protected health information of 4,022 patients was stolen from a surgeon’s vacation home in Hawaii in February 2013. OHSU notified 3,044 patients of the second breach in July 2013, in which residents and physicians-in-training in three departments had been storing patient information in a Google-based cloud system, though the health system did not have a contractual relationship to store patient information there.
OHSU indicates none of the affected patients have reported any harm from the data breaches.
“OHSU is continuously working to improve protection of patient information data in a constantly changing security and technology landscape. The two breaches that occurred in 2013 were stark reminders to OHSU how vigilant we must be. We made significant data security enhancements at the time of the incidents and now are investing at an unprecedented level in proactive measures to further safeguard patient information,” said Bridget Barnes, OHSU CIO, in a statement.
The health system plans to work with external consultants to enhance protections and meet the requirements of the corrective action plan.
More articles on HIPAA:
Catholic Health Care Services agrees to $650,000 HIPAA violation settlement
Former ProMedica employee found guilty of HIPAA violation
HHS: Ransomware attacks considered breaches in most cases
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.