A North Carolina county could be in major violation of HIPAA laws after mistakenly releasing hundreds of patients’ private medical records to a Charlotte TV station that was investigating a medical story.
The Health Insurance Portability and Accountability Act, or HIPAA, was enacted in 1996 to ensure patient privacy rights.
Mecklenburg County manager Dena Diorio revealed Tuesday afternoon that the county mistakenly released the private medical records of some 1,200 patients to the media. The county attorney confirmed patient health information was compromised.
"I'm absolutely speechless with anger at how something like this could happen," Diorio said.
Channel 9 had requested public records related to the county's failure to notify nearly 200 women about abnormal Pap smear results.
While WSOC-TV received that information Monday, the county also mistakenly included detailed medical history about hundreds of patients. The information included an Excel spreadsheets documenting the patients’ full names, addresses and dates of visits.
For some patients it also included a detailed description of why they visited and what services they received.
Diorio said the information should not have been in spreadsheets in the email and the practice of putting medical information in Excel sheets will end immediately.
Diorio said she believes the release is a category 2 HIPAA violation with a minimum fine of $1,000 per violation up to $50,000.
A county worker collected the records Tuesday morning from WSOC.
“We do everything we can to protect the personal information for all of our patients,” Mecklenburg County Manager Dena Diorio said. “In this particular instance, the checks and balances were not completely followed and we had a lapse."
Diorio said an IT staffer mistakenly included the information in the public records request. She also said no one checked the file before it was released.
“This was a person who works in our IT security area so it’s not as if everybody has access to this information,” she said.
It’s unclear if the hundreds of patients will be notified about the information leak. Diorio is planning to discuss the next steps with the county attorney on Tuesday.
