Michigan Department of Community Health Data Breach (2012)

Since 2003, the Michigan Department of Community Health has been secretly collecting the names, dates of birth, risk categories, and other demographic information of people submitting for confidential HIV testing at grant-funded locations throughout the state and storing them in a massive database, a months-long investigation by The American Independent has discovered. The database became apparent when the department confirmed to TAI that it had initiated an internal investigation into whether the private health information of thousands of people with HIV and their partners had been improperly released. The state’s investigation found that a contractor had emailed some data within the HIV Event System from a protected government server – without encryption – to an email address at the company that created and maintains the database for the state. The state determined that no private information was released. According to Rick’s report, the violation occurred late last year when an employee of A.J. Boggs & Company — a subcontractor that provides technology services to MDCH — sent an unencrypted email attachment to the company’s CEO that included thousands of pages of health and demographic information from the state’s HIV database.