Welcome to Skagit County
March 5, 2014
County reaches resolution with HHS over inadvertent disclosure of public
health receipts in 2011
MOUNT VERNON – Skagit County today signed a resolution agreement with
the U.S. Department of Health and Human Services (HHS) related to an exposure
of Health Department receipts containing protected health information during
a two week period in 2011. Citizens should be advised that the receipts were
only for health services received from January 1, 2011, through September
2011, and contained no full credit card numbers, social security numbers,
birthdates or addresses. However, some of these receipts identified certain
services that were provided by Skagit County Public Health Department.
Under the agreement with HHS, the County will pay a resolution amount of $215,000
and will be subject to a corrective action plan and monitoring.
As originally reported by Skagit County in a November 16, 2011 press release,
it was discovered in September of 2011 that certain receipts generated from
the Skagit County Public Health Department were inadvertently moved to a County
public web server that was consequently accessed by Google’s search engine.
Upon learning of the incident, the County immediately took aggressive steps
to remove the receipts from public exposure.
Since this incident, Skagit County has invested significant resources to increase
protection of personal health care information. These efforts included retaining
the services of a cyber-liability security expert to conduct a risk analysis
of the County’s management of protected health information. As a result
of his findings, the County has provided security training to staff and installed
numerous system and facility upgrades to enhance security. Skagit County has
also reached out to other counties and municipalities to assist with their
HIPAA policies and security awareness.
Skagit County has been working closely with HHS and is committed to continuing
to work with HHS as part of the corrective action plan to ensure that Skagit
County is meeting all requirements concerning the protection of personal health
information.
“Skagit County understands the importance of safeguarding our patients’
personal information and takes this responsibility very seriously,” said
Skagit County Privacy Officer Donnie LaPlante. “We regret that this incident
occurred, and are committed to preventing any future occurrences.”
For more information, please contact: Donnie LaPlante, Skagit County Privacy
Officer at (360) 419-7602 or privacyofficer@co.skagit.wa.us