Notification of Potential Privacy Issue
We recently notified affected individuals of an incident in which a former employee used certain protected health information (“PHI”) to solicit CHI Health patients for the receipt of nutrition services. The former employee had lawful access to the PHI during their term of employment; however, certain files containing PHI were, unlawfully and without CHI Health’s authorization, retained after termination of employment. The former employee then used some of this information to contact CHI Health patients by email on October 4, 2018.
The files did not all include the same categories of PHI; however, all files included patients’ names, and at least one of the following categories: email address, date of birth, phone numbers, dates and types of appointments, diagnoses, anecdotal lab results, medical record number, treatment plans, visit notes, name of primary provider, diagnostic codes, name of the nutritionist, and applicable history. The files did not include: home addresses, Social Security numbers, drivers’ license numbers, insurance plan details, or credit card information.
We became aware of the incident on October 6, 2018, and immediately initiated a thorough investigation into the matter and consulted with legal counsel. All paper and electronic copies of the files were returned, and the former employee has represented, orally and in writing, that the files were not downloaded, copied, retained, used, archived or re-disclosed to any other parties, other than in the email solicitation. Additionally, we have confirmed the security of our network and electronic medical record system.
We take our role of safeguarding our patients’ information very seriously. We sincerely apologize and regret that this situation has occurred and we assure you that you can continue to have confidence in CHI and in your health care providers. Affected individuals may contact Jane Walton at: 888.212.9204 with questions.