FORT HARRISON – A recent report shows a pattern of patient privacy violations at the Veterans Affairs medical system. And the VA Montana at Fort Harrison has not been immune — with dozens of violations since 2011, including the apparent disappearance of a box containing the records of 171 patients.
Online news organization ProPublica obtained the data from the U.S. Department of Veterans Affairs and the U.S. Department of Health and Human Services Office of Civil Rights, which track violations of the the nation’s main privacy law — the Health Insurance Portability and Accountability Act, or HIPAA.
The report shows 59 HIPAA violations in Montana reported in 2011 or thereafter — 44 of them involving VA Montana (including two violations at the VA’s Denver office that involved Montana patients).
Nearly all of the HIPAA violations involved mistakenly sending information, bills or lab results to the wrong veteran.
But one violation stands out: Back in 2010, the VA in Sheridan, Wyoming sent a box with the records of 171 veterans to the wrong location — a VA warehouse at Fort Harrison, where a VA worker signed for it, according to a letter uncovered by ProPublica.
“Following receipt at the VA’s warehouse, the box was lost and never found,” the regional director of the USHHS Office of Civil Rights recounted in a letter to the VA in November 2011. The letter says it’s possible warehouse personnel forwarded the papers to the correct recipient, the Network Authorization Office. But the NAO was unable to confirm it ever got them. The VA revised its mail procedures as a result of the breach, the letter says, and instituted a new software system to the allow the NAO access to scanned records to perform its audits.
In another case, an unauthorized VA staffer found a patient’s cell phone number in medical records. In all cases, the VA provided credit monitoring services for those affected.
In an email a VA Montana spokesman noted that the most common violation — information mailed to the wrong veteran — occurred in just 18 of the more than 500,000 mailing VA Montana sent in Fiscal Year 2015. “Despite the incredibly low incidence of missed mailings, VA Montana has worked diligently to reduce them entirely by implementing strict staff procedures that emphasize quality and accountability,” the spokesman, Mike Garcia, wrote.
The VA requires annual privacy and information security training for all its employees and contractors, he said, and they are required to report all violations. In addition to the 44 violations connected to the VA, the ProPublica data shows 15 violations at health care providers and others in Montana.
Available details on most of those violations are sparse, but the incidents include the 2014 hack of data at the Montana Department of Public Health and Human Services, in which hundreds of thousands of pieces of sensitive information may have been vulnerable.
Original Content by KBZK