Bariatric patients' privacy was compromised, Crozer-Keystone says
The Crozer-Keystone Health System revealed Friday that about 900 bariatric-surgery patients' privacy was breached because of an email error. According to the health system, an employee sent an email June 20 to let bariatric-surgery program patients know about a support group. The email addresses were inadvertently placed in the "cc" or carbon-copy section of the email, rather than the "bcc" or blind carbon copy section, which made the addresses visible to all recipients.
The Crozer-Keystone Health System revealed Friday that about 900 bariatric-surgery patients' privacy was breached because of an email error.
According to the health system, an employee sent an email June 20 to let bariatric-surgery program patients know about a support group. The email addresses were inadvertently placed in the "cc" or carbon-copy section of the email, rather than the "bcc" or blind carbon copy section, which made the addresses visible to all recipients.
"We worked with our IT department and attempted to recall the messages, but were unsuccessful," says a notice to patients posted on the website of the health system, which is based in Springfield, Delaware County, and has five hospitals in the county.
Because the email message was about a bariatric-surgery support group, it "may have suggested the patients' treatment," the notice said, adding that Social Security numbers and financial information were not included.
The federal HIPAA law protects the confidentiality of individual health information, and requires businesses to provide notification following a breach.
Although Crozer-Keystone said it has no reason to believe that patients' information had been used in any way, it sent a letter to affected patients on Friday and set up a phone line (1-844-644-4305) to answer questions. Administrators are reviewing email procedures with staff.
"We deeply regret any inconvenience this may cause our patients," the notice said.
215-854-2720 @repopter