Department of Human Services Data Breach (2015)

Protected health information of 425 nursing home patients has been accidentally mailed to 12 nursing home facilities by the Iowa Department of Human Services. The HIPAA breach occurred in December 2015, although it was not discovered by Iowa DHS until January 22, 2016. Last month, all affected patients were sent a breach notification letter alerting them to the accidental disclosure of their data. According to Iowa DHS, it is unlikely that any patient data have been used inappropriately as they were sent to another HIPAA covered entity. The privacy breach occurred when Iowa DHS' Medicaid Enterprise Medical Services department sent roster reports to the nursing homes. Those reports contained the names, Medicaid identification numbers, insurance or government program information, and the facility where each patient currently resides. Upon discovery of the breach, Iowa DHS contacted all 12 nursing facilities and instructed them to shred the data they had received. All facilities have now confirmed that the data have been securely destroyed. Medicaid Director Mikki Stier issued a statement apologizing to all affected individuals for the privacy breach and confirmed that the HIPAA breach was reported to the Department of Health and Human Services' Office for Civil Rights in February. Patients affected by the incident have been advised of the methods they can use to reduce the risk of harm or loss, should they be worried about their data being misused.