Arc of Erie County New York Reports that 3,751 Patients’ PHI Was Disclosed on Internet in 30-Month Period

Apr 13, 2018


A supplier of person-centered facilities to people with developmental incapacities, The Arc of Erie County New York (The Arc), has informed that two spreadsheets listing the PHI of 3,751 patients were exposed to the public through the Internet without the requirement for verification for a period of longer than 30 months from July 2015 to February 2018.

The two spreadsheets in question might be seen via the Internet by illegal people as a result of wrong coding on the website. The mistake meant that link printed on the website brought opinions to a page where the spreadsheets to be accessed by anybody who logged on.

Those that experienced harm because of the breach, the majority of whom are developmentally incapacitated, had been registered in certain programs provided by The Arc. The Arc spreadsheets recorded confidential information including, but not limited to, names, diagnosis codes and Social Security numbers.

Upon finding the mistake in February 2018, The Arc erased the link to discontinue the access to the spreadsheets and brought in a team of forensic computing specialists and a data Security Company to probe into the breach and assist take action to restrict the harm caused to patients going forward. The Arc has also contacted search engine browser providers to make certain that any reference or links to the information are forever erased from the search engine results pages. There is no proof to indicate that the spreadsheets were accessed by illegal people or if any PHI has been copied or viewed, nor is there anything that would let it be removed as a possibility.

Anybody affected by the breach has been communicated and offered the opportunity to avail free credit checking and identity theft safety facilities for the next year.

To get rid of any additional secrecy breaches, the Arc has modified its policies and practices and increased its secrecy and data safety procedures. Extra additional teaching classes have also been given to the related staff.