Sensitive personal data for city, hospital employees released

May 25--A former third-party administrator of medical plans for Methodist Hospital and the city of Henderson inadvertently released sensitive medical information about 1,151 people over the last several years, but all entities involved maintain there is little danger of that personal data being misused.

The information pertained to 143 people covered by the hospital's pharmacy plan in 2011-12 and more recently to 1,008 people covered by the city of Henderson's health plan.

The information was released by Medical Benefits Administrators Inc. of Newark, Ohio, more commonly known as MedBen, and according to City Attorney Dawn Kelsey, the problem was discovered in March when the hospital was responding to the city's inquiries about setting up an employee health clinic. In reviewing information provided by the city's health insurance broker the hospital discovered hospital plan data had been mixed in with the city's information.

That prompted both the hospital and the city to launch investigations. Kelsey said the city's investigation showed back in June of 2012 the city had asked MedBen to generate a report on pharmacy benefits. The MedBen pharmacy benefits manager "generated the report but inadvertently included other health plan participants from other health plans on the report. No one noticed that the report included participants in other health plans until the hospital viewed the report in March of this year."

Kelsey said the report included personal data about two individuals not affiliated with either the city or the hospital. "The city has contacted those companies and informed them of the issue."

David Park, general counsel for Methodist Hospital, said the health data of 143 individuals was mistakenly shared with the city of Henderson, as well as a Pharmacy Data Management Inc., a trading partner of MedBen. "We've notified all those people that their information was released," Park said.

Several other companies that were contemplating doing business with the city also received the information.

The city data released, all of it protected under the federal Health Information Privacy and Accountability Act (HIPAA), included names of plan participants, insurance identification numbers, addresses, gender, birth date, and information about the treatment, diagnosis, prescriptions, expenses, providers and -- if applicable -- workers' compensation claims.

Hospital data released included the same types of information but also included Social Security numbers. "That was one of the reasons we went the extra step of allowing people to track their credit reports," Park said, noting the hospital is paying for a one-year identity protection service through the credit rating service Experian.

The city data did not contain Social Security numbers. Kelsey said the city does not intend to offer a similar service to its employees, and she had no comment when asked whether the city is contemplating legal action against MedBen.

The city ended its business relationship with MedBen before the problem came to light.

The hospital also severed its relationship with MedBen before discovery of the problem. When asked if the hospital contemplated any legal action against MedBen, Park replied that if people's credit ratings were to be affected "then MedBen is the party that should answer to that. We expect MedBen to cover our expenses and to cover any damages. At this point we have not determined any damages have occurred."

MedBen CEO and President Kurt Harden, when asked for comment, provided a copy of a letter sent Monday to Park by Caroline F.R. Fraker, MedBen's vice president for compliance. That letter noted MedBen had made changes in its computer system to ensure reports containing HIPAA information could not be shared without being double-checked by a second employee.

The MedBen employee responsible for the release has been reprimanded and all parties who erroneously received the information have been asked to provide certification they have destroyed it.

"Fortunately, the disclosures were all made to covered entities like the city of Henderson or their business associates, which are also bound by the HIPAA privacy and security regulations," Fraker wrote. "For these reasons, we do not believe the disclosures caused harm to any of the individuals whose information is disclosed. Even so, MedBen regrets the error and has revised its practices to ensure this situation does not recur."

___

(c)2014 The Gleaner (Henderson, Ky.)

Visit The Gleaner (Henderson, Ky.) at www.courierpress.com/news/gleaner

Distributed by MCT Information Services