September 20, 2021

Volume XI, Number 263

Advertisement

September 17, 2021

Subscribe to Latest Legal News and Analysis

DOH Employee Error Causes Breach of COVID-19 and Other Health Data Affecting Nearly 165,000 Individuals

In a recent post, we highlighted the need for a privacy and cybersecurity training program, one not solely focused on spotting phishing attempts (although that is quite important as well). A primary reason, quite simply, is that employees continue to be a leading cause of data breaches. This fact was reaffirmed for the Wyoming Department of Health (WDOH) when an employee mistake resulted in the disclosure of nearly 165,000 Wyomingites. And, the risk is only amplified in the current remote work environment.

The WDOH announced on April 27, 2021, that it had inadvertently exposed 53 files containing COVID-19 and Influenza test data and 1 file containing breath alcohol test results. Some of the files had been exposed as early as November 5, 2020, but WDOH did not discover the incident until March 10, 2021. According to WDOH, the files included the name or patient ID, address, date of birth, test result(s), and date(s) of service, but did not contain social security numbers, banking, financial, or health insurance information.

The breach resulted from an “inadvertent exposure” of the files by a WDOH workforce employee who mistakenly and impermissibly uploaded the files to private and public GitHub.com repositories, resulting in disclosure to unauthorized individuals. Notably, WDOH intended GitHub.com, an internet-based software development company, to be used by its employees only for software code storage and maintenance.

It is not clear why the WDOH employee uploaded 54 files containing patient test result data, including COVID-19 test results, to a service intended for the storage of coding data. And, we do not know whether the employee in this case received training on the purpose and use of GitHub.com. However, according to WDOH’s announcement, the files were promptly removed from GitHub.com, the employee was sanctioned, and WDOH retrained its workforce on data privacy and security best practices.

Certainly, mistakes processing personal information are going to happen and no amount of training will prevent all data incidents and breaches. There is no silver bullet. An important question for an organization to ask, however, is whether reasonable steps are being taken to minimize the risk to data, even with regard to inadvertent errors in handling and with regard to use of company systems, among other things.

Training can be one of a number of tools organizations use to create a culture of privacy and security. Increased awareness can help to minimize, even if not eliminate, inadvertent errors. The white paper we provided in our earlier post outlines several considerations for developing a robust program designed to continually remind employees of the vigilance needed to protect personal information from unauthorized access, acquisition, modification, and disclosure. It is and will continue to be an ongoing challenge, particularly in the current environment with workplaces shifting as we emerge from the harshest effects of the pandemic.

Jackson Lewis P.C. © 2021National Law Review, Volume XI, Number 118
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement

About this Author

Principal

Joseph J. Lazzarotti is a principal in the Berkeley Heights, New Jersey, office of Jackson Lewis P.C. He founded and currently co-leads the firm's Privacy, Data and Cybersecurity practice group, edits the firm’s Privacy Blog, and is a Certified Information Privacy Professional (CIPP) with the International Association of Privacy Professionals. Trained as an employee benefits lawyer, focused on compliance, Joe also is a member of the firm’s Employee Benefits practice group.

In short, his practice focuses on the matrix of laws governing the privacy, security, and...

973- 538-6890
Advertisement
Advertisement
Advertisement