For more information, contact:
Brenda Harrison, Director of Community Relations
Phone-479-964-5687 Cell-479-886-3660
[email protected]
Saint Mary’s Regional Medical Center Provides Update on Data Breach
September 24, 2010. RUSSELLVILLE, ARKANSAS. In the early morning hours of Wednesday, September 22, Saint Mary’s Regional Medical Center was informed by a reporter with KTHV-TV that papers containing information on two patients had been found by a truck driver near Little Rock, Arkansas. The reporter sent photos he had received from a driver who said she retrieved them from the grill of her vehicle some time after having driven by “thousands” of papers on the interstate.
The hospital has taken extensive measures to locate the suspect papers on the interstate, as well as launched a comprehensive investigation, which now involves the police.
Saint Mary’s Regional Medical Center’s CEO Mike McCoy takes this situation very seriously and wants to make certain that the hospital’s patients, employees and medical staff as well as the community have the latest facts about the patient data breach.
“First, we want to thank everyone who has assisted us in this investigation, including the truck driver, reporter, law enforcement, business partners, and, of course, our staff. We have taken extraordinary measures in our investigation, which will continue until we have the answers we need or all efforts have been exhausted.
“Let me assure you that the safety of our patients and respect for their privacy is our top priority. Saint Mary’s has already launched a full investigation, requesting the assistance of local law enforcement authorities as well. Our investigation includes a comprehensive review of all internal policies and procedures. Any breach in our security procedures is unacceptable. Saint Mary’s will fully cooperate with all law enforcement investigators and will be as transparent as possible with the public. We deeply regret that any patient information was compromised and we sincerely apologize to the two patients this has impacted.
“It is important for the community to know that while we were able to find approximately 250 pages of health-related papers along Interstate-40 near Forest City, only two pages involved patients from Saint Mary's. The rest of the pages recovered appear to be from a 3-ring binder related to diabetes education not associated with Saint Mary’s. However, our priority is to determine how any patient information was able to leave our hospital premises.
“We want to stress that the incident appears to be much more limited in scope than seemed at first. Below is a more detailed chronology so that the public will know what we have done to date.”
Wednesday, September 22
Saint Mary’s Community Relations Director was informed at approximately 2:30 a.m. that papers containing protected health information (PHI) on two patients had been found along the interstate near Little Rock. We were notified by KTHV-TV who had received photos of the two papers from a truck driver who said she retrieved them from the grill of her vehicle. From the photos, we were able to tell that they were Admitting “face sheets.” We were able to learn the patients’ names and that both were treated in our ED on Monday, September 20.
• We requested the assistance of the Arkansas State Police shortly after we were notified around 2:30 a.m. They had several officers drive the area where the truck driver said she had seen “thousands” of papers; however, they were not able to locate any additional papers.
• We also asked our business partners at Shred-It to assist in the search because their office was closer to the site than we were. We sent representatives of our hospital to search the area as well.
• In all on Wednesday, approximately 200 miles of interstate was searched by several different entities with no discoveries of additional documents.
• We contacted the State Transportation Department and two professional document handling vendors, but neither had received any reports of spills of documents on or along the highways as they would routinely have been.
• We began interviewing our staff to see if anyone had information that could be helpful.
Thursday, September 23
Saint Mary’s was contacted at approximately 7 a.m. by the truck driver who originally reported the incident. She called to say that she had located the site where she had seen papers the day before, approximately 80 miles from the location she had previously reported. She told us she had left the two papers she had found on her truck grill strapped to the Mile Marker 241 sign post for the hospital to retrieve.
• Saint Mary’s immediately deployed staff to this location. Again, as a favor to us and at our request because their office is closer to the newly reported location of the incident, an employee of Shred-it document handling company went to the site to assist in locating and retrieving any documents so that it could be done as quickly as possible.
• Saint Mary’s CEO Mike McCoy and Safety and Security Officer Steve Olson arrived at the scene shortly after Shred-it. The Shred-It employee immediately provided the additional documents he had just retrieved from the site to our officials. McCoy and Olson traveled to the site to ensure that every possible document was retrieved and handled properly.
• However, the hospital learned later that the Shred-it employee was unable to retrieve all of the documents because a reporter for KTHV-TV had taken the original documents that we had been told had been secured to the sign post. The reporter also told Saint Mary’s he was in possession of another paper that bore the name of a physician, therapist and patient NOT associated with Saint Mary’s. The reporter was informed that possession of federally protected PHI is unlawful and that the information should be handed over to the health care provider or destroyed immediately.
• Between 200 and 300 pages were found in the search and clean-up. With the exception of the three documents in the reporter’s possession, every page was part of two three-ring diabetes education binders not associated with Saint Mary’s.
• We’re uncertain how only the three documents containing patient information managed to find their way onto the grill of a passing vehicle. However, our priority is to determine how any patient information was able to leave our hospital premises.
“Clearly, these two papers should not ever have been in the possession of someone not affiliated with our hospital or with these patients’ specific care. Our hospital’s investigation is continuing and we are confident that with the help of the Police Department and other law enforcement officials, we will find out what happened. And we will take any steps necessary to assure our patients that in addition to the highest quality of healthcare, their privacy is paramount to us.”
The hospital met with the Police Department on Thursday, September 23, to officially request that an investigation be launched. If anyone has any information that could assist in the investigation, please contact either the police or Paula Page, Privacy Officer at Saint Mary’s Regional Medical Center, at 964-9110 or by email at [email protected]