Patient Information Shared With Local Neurology Practice Without Authorization; URMC Notifies Patients

URMC has sent letters to 3,403 patients, informing them that a list containing patient information was shared, without authorization, with a local neurology practice.  We do not believe the information was shared with any other party, but we are informing patients in compliance with federal HIPAA regulations. 

The text of the letter is provided below.  Patients who have questions should call toll free, 1-866-329-9387, Monday through Friday between 9 a.m. and 7 p.m. Eastern Time.

Dear Patient:

I am writing to inform you of an incident involving your protected health information at the University of Rochester Medical Center (URMC).

On April 24, 2015, we became aware that a list of patients in URMC’s Neurology Department was shared with an outside neurology practice, Greater Rochester Neurology. This occurred without our authorization, and we are notifying you because some of your patient information was contained on that list. The list contained patient names, addresses, medical record numbers (these were internal URMC patient numbers), dates of birth, gender, diagnosis, and the date that patients were last seen by one of our health care providers.  Please know that the list did not contain any treatment information, social security numbers, or insurance information.

The list was shared around April 1, 2015, by a URMC nurse practitioner who had recently announced that she was leaving URMC to take a position with Greater Rochester Neurology. She had requested the list to help ensure continuity of care for the patients she was leaving, and she was provided the list for that purpose. She did not have permission from URMC to share the list outside the institution, nor did she have authorization from the patients whose information was on the list.  We sincerely apologize that this occurred.  

We investigated and learned that Greater Rochester Neurology used the list to send letters to patients, informing them that the nurse practitioner was joining their practice and advising them of the option to be treated at their facility.

While the list should not have been provided without your permission, it is worth noting that as a health care provider, Greater Rochester Neurology is held to the same federal privacy requirements that we are.  They have assured us that they did not disclose any of your information to any third party, and that they used the information for no other purpose than to send letters to some of the patients on the list. Greater Rochester Neurology has returned the list to us and has attested in writing that they have made no copies and will not further use or disclose any information. In addition, URMC is making our clinical staff aware of the incident and is clarifying their responsibilities regarding protected health information.

Even though we have no knowledge that your information has been used for any other purpose, it is our responsibility to make you aware of this situation in order that you can be alert to any signs of possible misuse of your information. 

As a health care organization, protecting your privacy is among our highest priorities.  On behalf of the University of Rochester Medical Center, I sincerely apologize for this incident.  If you have any questions or need additional information, please do not hesitate to call toll free 1-866-329-9387, Monday through Friday between 9 a.m.  and 7 p.m. Eastern Time.

Sincerely,

Robert G. Holloway, MD, MPH

Professor and Chair, Department of Neurology