VA Heartland Network (VISN 15)

Report ID: PSETS0000085922, U.S. Department of Veterans Affairs

Reported Entity: VISN 15 Poplar Bluff, MO

Issue:

A box of Concurrent Monitor Worksheets for High Acuity patients was found in an unsecured area. The room was open without anyone in the room. The Privacy Officer (PO) is unable to determine how long the box was in the room. The worksheets have several patients' information attached with the name, full SSN diagnoses, vital signs, age, medications, and allergies. Housekeeping told the PO that they were given the box because the employee didn't want it back. Update: 02/21/13: The box was found in a room where people were working from time to time, however, at the time the box was found, there was no on in the room or anyone close around the room. The general area is accessible to the public. There are no cameras pointing around or to the room. As the PO is going through the box, she believes there may be more than 500 names in the box. She does not have an exact number as of yet, but is working on it. She has not found out how long the box had been in there or if the box was full or not. When retrieved from the room, it was only half full. 02/25/13: The PO brought the box back to her office to secure it as well as go through the box. The box contained Total Quality Improvement Concurrent Monitoring Worksheets for High Acuity Patients. The worksheets included full patient names, full SSN, vital signs, age, medications, allergies and also diagnoses. Some diagnoses did include sensitive 7332 information. (Sensitive 7332 protected information is alcohol abuse, drug abuse, HIV and sickle cell anemia.) There were a total of 597 Veterans listed on these worksheets. Of note, the room is accessible by Housekeeping and Engineering staff and there are no cameras that provide continuous surveillance of individuals entering or accessing the room. The general public can access this particular area in the hospital. Around February 2012, there was construction being performed in the same room in which the box was stored, which resulted in contractors also having access to the room and personally identifiable information (PII) and protected health information (PHI) in the unsealed box. When the room was discovered opened and unattended by Environment of Care (EOC) personnel on 02/20/13, it was likely due to the fact that Environmental Management Service (EMS) personnel had left the room open for an unknown amount of time with the intention of securing the door upon completion of their tasks. However, during the timeframe in which the unsealed box was placed in the room (since December 2011), it is impossible to determine how many employees and contractors accessed the room and had access to the unsealed box. Upon further questioning of the Housekeeping aide, he stated that he did not know that PII or PHI was in the unsealed box. He also stated that the box felt the same weight as when he first picked the box up when moving the Stress Lab; however, we are still unable to determine if any information was 02/27/13: The box was placed in the storage room in 2011, however the information dates back to 2007, 2008, and 2009. The local Incident Resolution Team met and will proceed with the letters. 03/08/13: When the PO was going through all SSNs to address and to determine the number of deceased, she realized there were some errors with duplicate numbers, so the total number of Veterans affected is now 589. 03/12/13: All of the names in the box had the full SSN attached. Of the total 589 patients affected, 329 patients will receive letters offering credit protection services and 260 family members of the deceased patients will receive next of kin notification letters.removed from the box or viewed by unauthorized personnel. Upon further fact finding, the employee who told Housekeeping that they didnt want the box back, is no longer employed by the facility and we are unable to determine the owner of the information at this time. 02/26/13: There are approximately 19-25 staff members in Housekeeping and Engineering who have access to the storage room in which the unsealed box of PII/PHI was found. Additionally, Compensated Work Therapy (CWT) staff and contractors, when they were constructing a wall in the room, also had access to the PII/PHI. These numbers do not include those employees who may have left the VA since December 2011. The exposure to the records lasted from about December 2011 to 02/20/13. And at this point, it is impossible to identify how many individuals accessed the room over the past 1 year, 2 months. There also could have been other times in which the door was left wide open. Exactly how many is not known, leading to exposure of those records outside Housekeeping and Engineering. There is no guarantee that those records were not accessed or viewed by any unauthorized individual, mentioned above, coming into contact with the box. The 597 Veterans will receive a letter offering credit protection services.

Outcome:

Training is being provided to all staff regarding the safekeeping of records and the importance of records management.