Hospital courier loses patient lab forms

July 29--BEVERLY -- A courier for Lahey Health'sBeverly Hospital last month lost lab request forms for 54 patients that included names, health insurance identification numbers and, in some cases, Social Security numbers.

The courier misplaced the forms, which were in a zippered bag along with other records, "somewhere between Beverly and Gloucester," according to a notification the hospital was required to file with the attorney general's office. Lahey Health is parent company to both Gloucester'sAddison Gilbert Hospital and to Beverly Hospital under the former Northeast Health System.

Beverly Hospital officials said they notified the 54 patients of the incident by mail and has undertaken a "comprehensive review" of its courier service, including retraining of couriers and hospital staff.

In the letter to Attorney General Martha Coakley, Barbara McCarthy, the hospital's risk/privacy officer, said the hospital notified police of the lost forms but has no knowledge of the information being used for fraudulent purposes.

"Patient care was not compromised," McCarthy wrote.

The attorney general's office said the incident is under review.

The records in question were lab requisitions, paper slips that patients get from their doctor and take into the lab at the hospital. The slips were bundled in a packet inside a zippered courier bag and were being taken from Beverly Hospital to Addison Gilbert Hospital for storage on June 11.

According to the hospital's account, the courier stopped at Beverly Hospital's health information management department on Brimbal Avenue to drop off some other records. The courier remembers taking the bag out of the van and reaching inside the bag for the records. When he got to Addison Gilbert, he could not find the bundle of lab requisitions.

The courier returned to Brimbal Avenue and went up and down Route 128 to look for the records, but he could not find them.

The courier works for Option Courier Services of Ipswich, which contracts with Lahey Health, the parent company of Beverly Hospital. The courier was given a written warning by his employer, according to McCarthy's letter. As part of the hospital's review of the incident, it plans to establish a "low threshold" for terminating its contract with the courier service.

A man who answered the phone at Option Courier Services declined to comment.

The hospital also said it would make sure each courier has a signed confidentiality statement on file, would retrain couriers in data privacy and security, retrain hospital staff in the proper packaging of records in a locked courier bag for transport between hospital facilities, and evaluate what kind of information is included on lab requisitions.

The hospital also notified the state Office of Consumer Affairs and Business Regulations of the security breach, which is required by law.

Denis Conroy, Lahey Health's chief executive officer of Beverly and Addison Gilbert hospitals, said in a statement that officials are working with the affected patients "to prevent and/or mitigate any potential impact" from the lost lab forms.

"We maintain an extensive privacy program designed to minimize the risk of these types of events," Conroy said. "Consistent with that commitment, and in an effort to improve our policies and practices, we have thoroughly reviewed this event and taken the appropriate steps to enhance our practices."

The attorney general's office has been notified of more than 5,000 data breaches in Massachusetts since 2008, ranging from lost records to criminal cyber-attacks, according to the agency's website. Hospitals and medical groups have agreed to pay several hundred thousand dollars in penalties in some of the larger cases, including this week's announcement that Women & Infants Hospital of Rhode Island will pay $150,000 after losing backup tapes containing the health information of more than 12,000 Massachusetts patients.

A portion of the payments go to a data protection fund used to improve the security and privacy of sensitive health and financial information in Massachusetts, according to the attorney general's office.

Staff writer Paul Leighton can be reached at 978-338-2675.

___

(c)2014 the Gloucester Daily Times (Gloucester, Mass.)

Visit the Gloucester Daily Times (Gloucester, Mass.) at www.gloucestertimes.com

Distributed by MCT Information Services