Kansas City Anesthesiologist Employee Loses Patient Surgery Schedules
Who: Anesthesia Associates of Kansas City
# of Records exposed: 3,472 Patients
When it occurred: December 14, 2018
What happened: Paperwork containing patient schedules and information has been stolen from an employee
How did it happen: The employee had left a bag containing patient schedules in his vehicle. Thieves broke into the vehicle and stole the bag and paperwork. Anesthesia Associates of Kansas City learned of the incident on December 16, 2018, and launched an investigation to determine what paperwork had been stolen. The types of information listed in patient schedules include names, birth dates, types of surgical procedures, dates of surgery, and the name of the surgeon. Schedules do not contain sensitive information such as addresses, Social Security numbers, insurance information, and financial information. It was not possible to determine with a high degree of certainty exactly which schedules were in the stolen bag.
Outcome: The theft was reported to law enforcement but neither the bag nor the paperwork has been recovered. A decision was taken to issue notification letters to all patients who had undergone surgical treatment between April 4, 2018, and December 14, 2018. All patients whose protected health information was potentially detailed in the patient schedules were informed about the breach by mail on February 1, 2019. All affected patients have been advised to monitor their accounts and explanation of benefits statements for any sign of fraudulent activity. The breach report submitted to the Department of Health and Human Services’ Office for Civil Rights indicates up to 3,472 patients’ protected health information may have been compromised. To prevent further data breaches of this nature in the future, Anesthesia Associates of Kansas City has reinforced its policy of prohibiting the non-essential removal of patient information from its clinics. New policies and procedures have also been developed and implemented to further safeguard patient information when it is necessary to remove it from its facilities.