Kentucky Healthcare System Exposes Patients’ PHI

A healthcare system located in Kentucky is notifying more than 40,000 patients of an error that saw their personal health information (PHI) emailed to the wrong address. 

UofL Health, which is based in Louisville, consists of five hospitals, four medical centers, nearly 200 physician practice locations, more than 700 providers, the Frazier Rehab Institute and Brown Cancer Center.

Earlier this month, the system notified the Health and Human Services Office for Civil Rights of an email security incident involving the unauthorized disclosure of data belonging to 42,465 individuals. 

Patients’ PHI was put at risk when it was erroneously sent to an email address outside of the health system’s network. According to UofL, the accidental recipient of the data did not view or access any patient information.

The healthcare system, which employs more than 12,000 physicians, surgeons, nurses, pharmacists and other highly skilled health care professionals, did not state what data was contained within the email.

In a notice posted to its website, UofL Health stated: “On June 7, we sent some of our patients a letter explaining that we had recently discovered that some UofL Health emails containing some of their health information were sent to an external domain. We provided that notice based on our best knowledge as of that day."

The notice went on to say that the email had since been deleted and that the safety of the data had been investigated.

“The next day, on June 8, we received a response from th ..

Support the originator by clicking the read the rest link below.