0

Phoebe Putney Memorial Hospital employees terminated over missing computer

Two Albany hospital employees found in violation HIPAA private policy regulations have been dismissed

ALBANY — Officials at Phoebe Putney Memorial Hospital have confirmed that two employees have been let go in connection to a computer that went missing from one of its clinics in November.

A spokeswoman at the hospital confirmed Friday that two employees were terminated because of Health Insurance Portability and Accountability Act privacy policy violations which led to the incident, and that no additional comment would be made regarding personnel.

Phoebe officials announced on Jan. 3 that notification was being sent to patients regarding a missing computer that may have contained sensitive information. Officials with the hospital said that, in early November, they learned a password-protected, unencrypted desktop computer had disappeared from one of its clinics. Phoebe contacted the Albany Police Department and began an internal investigation, including hiring an computer forensics company, to identify the information contained on the computer.

After conducting a detailed review, officials say it was determined the computer may have contained patient information including patient names, addresses, dates of birth, dates of service, physician’s names, diagnosis information, and — in some instances — Social Security numbers. The computer had not been located as of Friday.

Officials say the incident affected a limited number of patients who were treated between May 2010 and October 2013. The hospital began mailing notification letters last week to individuals who may have been impacted, offering those eligible a year of credit monitoring services and providing call center support for the patients.

“The privacy, security and safety of the Phoebe Putney community and the patient information it maintains are a top priority,” said Audrey Pike, vice president and chief compliance officer and privacy officer at Phoebe Putney Health System, said in a statement last week on the incident. “The hospital has taken the necessary steps to reinforce and refine staff procedures to strengthen the protection of patient information.”

A police report from the APD indicated the computer was reported missing from Phoebe’s behavioral health outpatient clinic at 500 W. Third Ave. at 9:40 a.m. on Nov. 7. The report’s narrative said an employee at the clinic stated she was at work until 7:30 p.m. on Nov. 5, and before she left to go home, she boxed up a Dell computer and left it in the hallway by her office to move it into a spare office. When she got back in at 7:30 a.m. on Nov. 6, it was gone, the report said.

The report goes on to say that a janitor was questioned about the box, and he said he thought it was trash and took it to the Dumpster. The Dumpsters were checked three times with no signs of the computer, the report said.