March 5, 2014

County reaches resolution with HHS over inadvertent disclosure of public health receipts in 2011

MOUNT VERNON – Skagit County today signed a resolution agreement with the U.S. Department of Health and Human Services (HHS) related to an exposure of Health Department receipts containing protected health information during a two week period in 2011. Citizens should be advised that the receipts were only for health services received from January 1, 2011, through September 2011, and contained no full credit card numbers, social security numbers, birthdates or addresses. However, some of these receipts identified certain services that were provided by Skagit County Public Health Department.

Under the agreement with HHS, the County will pay a resolution amount of $215,000 and will be subject to a corrective action plan and monitoring.

As originally reported by Skagit County in a November 16, 2011 press release, it was discovered in September of 2011 that certain receipts generated from the Skagit County Public Health Department were inadvertently moved to a County public web server that was consequently accessed by Google’s search engine. Upon learning of the incident, the County immediately took aggressive steps to remove the receipts from public exposure.

Since this incident, Skagit County has invested significant resources to increase protection of personal health care information. These efforts included retaining the services of a cyber-liability security expert to conduct a risk analysis of the County’s management of protected health information. As a result of his findings, the County has provided security training to staff and installed numerous system and facility upgrades to enhance security. Skagit County has also reached out to other counties and municipalities to assist with their HIPAA policies and security awareness.

Skagit County has been working closely with HHS and is committed to continuing to work with HHS as part of the corrective action plan to ensure that Skagit County is meeting all requirements concerning the protection of personal health information.

“Skagit County understands the importance of safeguarding our patients’ personal information and takes this responsibility very seriously,” said Skagit County Privacy Officer Donnie LaPlante. “We regret that this incident occurred, and are committed to preventing any future occurrences.”

For more information, please contact: Donnie LaPlante, Skagit County Privacy Officer at (360) 419-7602 or privacyofficer@co.skagit.wa.us