Stoney Blevins, health and human services director, said HCHHSA discovered the report was missing on Oct. 31, and the administration subsequently launched an investigation into the incident that included the participation of the Haywood County Sheriff’s Office.
Blevins said a billing worker had printed off a small subset of information from a larger state report as a working copy, and that the report went missing. The investigation is ongoing and remains a top priority for HCHHSA, but Blevins said he doesn’t know if the report is just missing or was stolen.
“Our office is a double locked office, but I really don’t know — someone could have picked it up accidentally, but we’ve turned the office upside down trying to find it,” he said.
Based on the investigation, HCHHSA determined that the report included North Carolina Health Information System (HIS) patient numbers; patient full names; a short descriptive caption identifying the HCHHSA clinic visited; and the amount in HCHHSA’s accounts receivable for each respective patient.
The report did not contain patient addresses, Social Security numbers, medical records, or dates of birth. HCHHSA has received no indication that the information has been further used or disclosed. Blevins said it was very unlikely anyone would be able to decipher the report or do anything harmful with the information.
“If you didn’t work for the health department, you wouldn’t understand the report,” he said.
A letter was sent to each patient on the report pursuant to the data event notification requirements of the U.S. Department of Health and Human Services. Blevins said HCHHSA takes the privacy and security of patient information seriously.
Following this incident, HCHHSA is further enhancing security measures and its policies and procedures. While HCHHSA is not aware of any actual or attempted fraud or public disclosure as a result of this incident, HCHHSA encourages all concerned individuals to remain vigilant and to report any suspicious activity.
“I feel comfortable that our citizens are pretty safe, but we don’t like it when a mistake is made,” Blevins said. “We took the high road and reported it and sent letters to every patient on the list.”