Vendor Error Leads to Breach

Medicare Compliance Watch

CHI Franciscan Health Highline Medical Center (Highline) in Burien, Washington, is notifying more than 18,000 patients of a data breach affecting protected health information (PHI) stored with a vendor, Highline said in a statement.

On July 22, R-C Healthcare Management, a vendor that performed services for Highline prior to 2014, informed the hospital that files containing PHI were accidentally made accessible on the internet between April 21 and June 13. The affected files were used in account reporting functions between 1993-1994 and 2008-2013 and may have contained:

  • Dates of service
  • Health insurance information
  • Names
  • Social Security numbers

A total of 18,399 individuals are affected by the breach, according to the Office for Civil Rights’ list of breaches affecting 500 or more individuals.

Highline instructed R-C Healthcare to destroy the files. There is no evidence that any PHI was accessed by unauthorized individuals, the hospital said. Highline opened a dedicate call center to field questions and is offering free credit monitoring services to affected patients.