Noteboom The Law Firm

VA Finds Personal Health Care Information Improperly Shared Online

December 30, 2010 - The Department of Veterans Affairs (VA) has very explicit rules against sharing private health care information between facilities via online tools. Yet, in the last couple of months, at least 8 VA facilities have done this very thing. The most recent violation affected the personal medical information of 878 VA patients.

Recently it was discovered that the employees of the Chicago Health Care System Orthopedics Department were posting patients' information on a Yahoo! calendar. The VA's rules on such things are very clear and very adamant: systems outside the VA firewalls shall contain no patients' personal information. The personal information has been stored on the calendar since 2007, which is also the last time 4 of the employees changed their username and passwords. The information contained on the calendar included:

• Full names;
• Surgery dates;
• Types of surgery performed; and
• Patients' last 4 digits of their social security number.

All 878 affected patients were given notice of the violation via letter, all the information has been removed from the site, and access to the site was blocked. The VA's Chief Information Officer, Roger Baker, has said that this is an issue that will likely continue to repeat itself. In fact, the majority of the time the VA is only going to be alerted to these types of information sharing violations by people reporting them.