Protected Health Information / Police

Still Need Coffee

Question for those of you out there whose businesses deal with protected health information (PHI / IIHI).

If you had a situation where there may have been a breach of PHI, would you notify the police? My research shows that most of the time the police aren't notified unless an actual identity theft happens, not just when the information goes outside your organization.

Thoughts? I know I'm being cryptic, but I'm sure you can understand why

joannie

I would definitely alert the employees whose PHI was breached, but alerting the police would depend on the circumstances surrounding the breach. Were e-files hacked? Physical files broken in to? Mail inadvertently opened? Who committed the breach? etc.

sonny

Agree as abpve. .need more information

Still Need Coffee

Basically we had an ex employee, who, in the days leading to termination, sent a bunch of the PHI to their e-mail home address (our company works with PHI - this isn't employee PHI).

We're drafting a remediation plan for the breach, and someone tossed out the police idea.

My thought is that unless there was actual criminal activity (namely, identity theft, stolen laptop, etc), police shouldn't be contacted. Instead, the affected parties should be given info on contacting the credit bureaus, and if they suspect fraud, to alert the authorities.

ptripp

Just curious to why this individual would send other individuals PHI information to their home e-mail unless they planned on using it for some reason.

If it were me I think you have an obligation to those individuals to report it.

Still Need Coffee

We think she was sending it to herself to prove proper case handling on her part, as she was on a disciplinary plan for poor work product.

I'll keep you posted.

joannie

Coffee,

I think I would report it to the police. Reasoning - we have a policy concerning proprietary information and unauthorized dissemination thereof. Company files would fall under this policy. By e-mailing them to herself, she has stolen proprietary info.