Stanford University Hospital Security Breach Affects 20K Patients, Could Cost Hospital $20M

<p>
A spreadsheet containing health data on approximately 20,000 emergency department patients from Palo Alto, CA-based Stanford University Hospital was recently discovered posted on a website that was unrelated to the hospital.</p>
<p>
The data, which included personal health information such as patient names, diagnosis codes, admission and discharge information and billed charges, had been posted on the website for about a year, according to a report from the <em><a href="http://www.nytimes.com/2011/09/09/us/09breach.html?_r=2">New York Times</a></em>. &nbsp;</p>
<p>
While this particular security breach won&rsquo;t affect quite as many patients as the <a href="../../news/tricare-data-security-breach-may-be-largest-since-2009-affects-nearly-5-million-military-health-system-patients">recently-reported Tricare breach</a> will, it certainly highlights the fact that loss or misused of personal health information by healthcare employees or business associates seems to be a more significant security risk than hacking or malevolent attacks on electronic healthcare records systems.</p>
<div style="page-break-after: always;">
<span style="display: none;">&nbsp;</span></div>
<p>
In fact, a recent report that analyzed government security breach data showed that only six percent of incidents that involved compromised health data security actually involved hacking.</p>
<p>
In this case, the data was compromised by a Los Angeles-based billing contractor called Multi-Specialty Collection Services, which had obtained the spreadsheet from Stanford during the normal course of operation.</p>
<p>
It was posted to a website called Student of Fortune, which was designed to help students hire people to help with their homework. It was posted on September 9, 2010 as an attachment to a forum question on how to construct a bar graph.</p>
<p>
Stanford said it was unaware of the posting until it received a report from a patient who had found it on the site on August 22.</p>
<p>
In response to the incident, Stanford suspended the billing contractor and launched an investigation. The organization is also offering free identity theft protection to any affected patients, although social security numbers and other identifying information were absent from the spreadsheet.</p>
<p>
Multi-Specialty has taken full responsibility for the breach. The new HIPAA security rules, expected to be finalized over the next few months, will increase the security requirements for data shared with the business associates of healthcare providers&mdash;but as this incident proves, it&rsquo;s not always easy to control business associates, despite what their contracts might say.</p>
<p>
&ldquo;We sincerely apologize for the concern this has caused our patients,&rdquo; said Diane Meyer, Stanford&rsquo;s Chief Privacy Officer, in a <a href="http://stanfordhospital.org/newsEvents/newsReleases/2011/medical-records-update.html">statement</a>. &ldquo;We value the privacy of patient health information and are committed to protecting it at all times. Our contractors are explicitly required to&nbsp;commit to strong safeguards to protect the confidentiality of our patients&rsquo; information.&nbsp; We have worked extremely hard to identify all the&nbsp;parties responsible.&nbsp; No Hospital staff member was involved in posting the file to the website.&nbsp; We will continue to take aggressive action to hold all responsible parties accountable.&rdquo;</p>
<p>
<strong>A $20 Million Mistake?</strong></p>
<p>
As a result of the security breach, former Stanford patient Shana Springer, who was treated in the ER in 2009, is representing 20,000 patients in a <a href="http://www.modernhealthcare.com/Assets/pdf/CH75853106.PDF">complaint</a> filed in the Los Angeles County Superior Court.</p>
<p>
Springer is seeking damages worth $1,000 per patient, a total of about $20 million.</p>
<p>
In a <a href="http://stanfordhospital.org/newsEvents/newsReleases/2011/statement.html">statement</a> released October 3, Stanford responded to the class action lawsuit by saying that while it sincerely regretted that its patients&rsquo; confidentiality had been compromised by Multi-Specialty, it &ldquo;intends to vigorously defend the lawsuit that has been filed as it acted appropriately and did not violate the law as claimed in the lawsuit.&rdquo;</p>
<p>
<strong>What do you think? Is Stanford to blame for the security breach, and is it responsible for damages? Tell us in the comments. </strong></p>
<p>
<em>You Might Also Like:</em></p>
<ul>
<li>
<a href="../../news/tricare-data-security-breach-may-be-largest-since-2009-affects-nearly-5-million-military-health-system-patients">Tricare Data Security Breach May Be Largest Since 2009, Affects Nearly 5 Million Military Health System Patients</a></li>
<li>
<a href="../../news/how-a-digital-lockbox-saves-money-and-prevents-fraud">How a Digital Lockbox Saves Money and Prevents Fraud</a></li>
<li>
<a href="../../news/how-a-digital-lockbox-saves-money-and-prevents-fraud">How a Digital Lockbox Saves Money and Prevents Fraud</a></li>
</ul>