Press Release

 

Dear Coalfield Health Patient:

 

We regret to inform you that on July 22, 2019, we discovered an incident that may have compromised the confidentiality of your personal health information. All patients involved in this compromise have been notified by first class mail. However, patients who did not receive a letter, may contact us directly to confirm their status.  Although we believe it is highly unlikely that your information will be misused as a result of this incident, we are providing you with this notice out of an abundance of caution and to comply with our obligations under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). To ensure that we reach all patients involved, you will see this notice on our website and in the media in the near future, again to lessen any possibility of harm to our patients.

 

Coalfield Health Center is participating in a research program with the West Virginia Department of Health and Human Resources Bureau for Public Health, Division of Health Promotion and Chronic Disease, with the goal of improving patient outcomes by learning information from statistical data.  Coalfield Health Center agreed to share nonidentifying health information with the West Virginia Department of Health and Human Resources Bureau for Public Health, Division of Health Promotion and Chronic Disease in order to further this goal.

On July 10, 2019, an employee of Coalfield Health Center's research partner, with whom Coalfield has a valid Business Associate Agreement required by HIPAA, inadvertently uploaded files containing patient names, addresses, and diagnostic codes to a secure West Virginia University web portal.  This data did not include social security numbers, financial information, or birth dates. The employee also forwarded the files via email to the West Virginia Department of Health and Human Resources Bureau for Public Health.  Unfortunately, the partnering organization did not have a business associate agreement of its own to cover these inadvertent disclosures.  Only de-identified data was supposed to be uploaded by this research partner, and the mistake was unintentional.

 

Fortunately, immediately after becoming aware of the disclosure, both Coalfield Health Center and its Business Associate investigated the incident and took the necessary precautions to secure the information.  This effort included contacting the recipient of the e-mail to ensure that the files were properly deleted, as well as removing the files from the web portal. While we do not believe that any patient information was retained by the recipients, this notice is being provided out of an abundance of caution and to comply with the letter and spirit of HIPAA.

To date, we have not received any information from any of the affected patients that would suggest that any person's personal information has been accessed or used improperly.  However, if you are concerned, we advise you contact us with any questions about this incident or if you need additional information on what you should do as a result of the breach, at toll free number 877-543-3006, email kdial@coalfieldhealth.com, www.coalfieldhealth.com, and/ or mail P.O. Box 4013 Chapmanville, WV 25508.

 

Sincerely,

Kristin Dial, Executive Director