The Delaware Division of Developmental Disabilities Services Data Breach
DOVER (Oct. 21, 2022) – The Delaware Division of Developmental
Disabilities Services is announcing today that it is mailing letters to
service recipients and legal guardians who were impacted by a recent
data breach incident and is providing information to the public
regarding the incident.
On August 23, 2022, staff within the Division of Developmental
Disabilities Services (DDDS) discovered that in the process of creating
new user accounts in the division’s client database, DDDS staff
inadvertently provided access to individual records of 7074 individuals.
As a result of these actions, 159 new users had potential access to
service recipients’ personal, identifiable information and protected
health information as well as potential access to more detailed
information through accessed accounts.
A thorough investigation of the incident was conducted. Using
forensic analysis available through the software’s vendor, the division
has been able to determine how many users accessed information not
intended for their use, and which service recipient records were opened
and viewed. While the division has determined that only 12 detailed
records were actively accessed, certain personal, identifiable
information and protected health information was passively available to
any user with the erroneous access level. The software vendor is unable
to determine who may have passively viewed this information.
Based on this internal investigation and consultation with the
software vendor, the division is taking corrective measures to tighten
security and protection of the personal health information of its
service recipients. DDDS has:
- Reviewed and reinforced its Health Insurance Portability and Accountability Act (HIPAA)-related policies and procedures.
- Established new guidelines for the creation of user accounts and a tightened approval process for accessing records.
- Worked with its vendor to institute technology checks on providing access.
The division will incorporate lessons from this analysis into the
design and implementation of its new client data management system
scheduled for transition in 2023.
As required by HIPAA and state law, the Delaware Division of
Developmental Disabilities Services has reported this breach to the U.S.
Department of Health and Human Services and to the Delaware Department
of Justice.
The Division of Developmental Disabilities Services is also
establishing a dedicated call center independently staffed by a
contracted company to answer any questions about this incident. Call
center representatives have been fully versed on the incident and can
answer questions or concerns individuals may have regarding protection
of their personal information. Additionally, the division will be
offering free access to credit monitoring to all impacted parties for a
period of one year.
| Hospital Revises Email Distribution as a Result of a Disclosure to Persons Without a "Need to Know" Covered Entity: General Hospital Issue: Impermissible Use and Disclosure A complainant, who was both a patient and an employee of the hospital, alleged that her protected health information (PHI) was impermissibly disclosed to her supervisor. OCR’s investigation revealed that: the hospital distributed an Operating Room (OR) schedule to employees via email; the hospital’s OR schedule contained information about the complainant’s upcoming surgery. While the Privacy Rule may permit the disclosure of an OR schedule containing PHI, in this case, a hospital employee ...read more |
| Direct Liability of Business Associates In 2009, Congress enacted the Health Information Technology for Economic and Clinical Health (HITECH) Act,1 making business associates of covered entities directly liable for compliance with certain requirements of the HIPAA Rules. Consistent with the HITECH Act, the HHS Office for Civil Rights (OCR) issued a final rule in 2013 to modify the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules.2 Among other things, the final rule identifies provisions of the HIPAA Rules that apply directly to business associates and for which business associates are directly liable.3 As set forth in the HITECH ...read more |
| HHS Issues Guidance on HIPAA and Audio-Only Telehealth Today, the U.S. Department of Health and Human Services (HHS), through its Office for Civil Rights (OCR), is issuing guidance on how covered health care providers and health plans can use remote communication technologies to provide audio-only telehealth services when such communications are conducted in a manner that is consistent with the applicable requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Security, and Breach Notification Rules, including when OCR’s Notification of Enforcement Discretion for Telehealth - PDF is no longer in effect. This guidance will help individuals ...read more |
| If a CSP stores only encrypted ePHI and does not have a decryption key, is it a HIPAA business associate? Answer: Yes, because the CSP receives and maintains (e.g., to process and/or store) electronic protected health information (ePHI) for a covered entity or another business associate. Lacking an encryption key for the encrypted data it receives and maintains does not exempt a CSP from business associate status and associated obligations under the HIPAA Rules. An entity that maintains ePHI on behalf of a covered entity (or another business associate) is a business associate, even if the entity cannot actually ...read more |
|
August 2026
| Su | Mo | Tu | We | Th | Fr | Sa |
| | | | | | 1 |
| 2 | 3 | 4 | 5 | 6 | 7 | 8 |
| 9 | 10 | 11 | 12 | 13 | 14 | 15 |
| 16 | 17 | 18 | 19 | 20 | 21 | 22 |
| 23 | 24 | 25 | 26 | 27 | 28 | 29 |
| 30 | 31 |
Blog Home
Newest Blog Entries
1/21/25 Understanding Business Associate Agreements
11/12/22 Modernizing Medicine Agrees to Pay $45 Million to Resolve Allegations of Accepting and Paying Illegal Kickbacks and Causing False Claims
11/12/22 Indian National Charged in $8 Million COVID-19 Relief Fraud Scheme
11/12/22 Former Hospital Employee Pleads Guilty To Criminal HIPPA Charges
11/12/22 Covered entities and those persons rendered accountable by general principles of corporate criminal liability may be prosecuted directly under 42 U.S.C. § 1320d-6
11/12/22 The Delaware Division of Developmental Disabilities Services Data Breach
11/12/22 OCR Settles Three Cases with Dental Practices for Patient Right of Access under HIPAA
11/12/22 HHS Issues Guidance on HIPAA and Audio-Only Telehealth
11/12/22 Five Former Methodist Hospital Employees Charged with HIPAA Violations
11/12/22 May a covered entity use or disclose protected health information for litigation?
11/12/22 When does the Privacy Rule allow covered entities to disclose protected health information to law enforcement officials?
Blog Archives
November 2022 (54)
January 2025 (1)
Blog Labels
Covered Entity (40)
BAA (4)
PPP Fraud (1)
HIPAA (2)
HIPAA Enforcement (3)
Data Breach (1)
Telehealth (1)
ePHI (2)
EHR Fraud (1)
|
