On Thursday, the Arizona Department of Health Services issued a notice to approximately 2,500 individuals to let them know of a possible breach of protected health information. The potential breach relates to information collected in the department’s Newborn Screening Program for billing purposes.
According to Arizona Department of Health Services (ADHS), the Department “does not have any indication the information has been accessed or used by an unauthorized individual, however, it will be important for those affected to be vigilant for fraud alerts.”
ADHS advises that it uses Midwest Medical Practice Management Inc., a third-party billing company located in Carbondale, IL, to conduct billing for newborn screening services. To do this, ADHS mails the billing company paperwork that contains the following protected health information for both mother and child: names, dates of birth; addresses; phone numbers; health insurance information; and possibly social security numbers.
On April 20, 2017, two parcels of billing documents containing protected health information were shipped by ADHS via the U.S. Postal Service to the billing company with individual tracking numbers assigned by USPS. Only one of the two parcels was delivered to the billing company. The parcel that was not delivered to the billing company included billing documents containing protected health information on patients who have been through our Newborn Screening Program.
According to the USPS Tracking site at usps.com, the parcel arrived at the USPS Facility in Phoenix, AZ 85043 on April 20, 2017, at 10:15 p.m. and as of April 22, 2017, at 5:15 a.m. had a status of “[i]n [t]ransit to [d]estination.” As of the date of this notice, the parcel has not been located by USPS and is still listed as “[i]n [t]ransit to [d]estination” on usps.com.
The USPS does not consider a parcel to be lost until 30 days have passed which was May 24, 2017. Because 30 days have passed since ADHS discovered the parcel had not been delivered to the billing company, ADHS is notifying affected individuals of the potential that their, and/or their child’s, protected health information may be compromised. USPS has no records of the parcel being misdelivered or compromised in any way. In addition, there is no indication the parcel has left USPS’ custody and the Department issued a statement saying it is hopeful that it will be located as USPS continues to search for the item.
As a result of this situation, ADHS is reviewing and evaluating its mailing process for NBS Program records. In addition, ADHS is continuing to work with USPS to determine the location of the parcel and identify what steps can be taken to prevent similar situations from occurring in the future.
Affected individuals will be notified by mail. If you have questions on this notification, please contact ADHS by phone at 1-800-548-8381 or email WebPIO@azdhs.gov.