A laptop stolen from a Pathways Professional Counseling employee’s vehicle in September contained unencrypted personal, clinical, financial, and insurance information. Alabama Baptist Children’s Homes & Family Ministries, d/b/a Pathways Professional Counseling (PPC) appears to be a hybrid entity under HIPAA. PPC has numerous locations throughout Alabama and describes itself as a non-profit counseling ministry. Here is the bulk of their public notice, issued November 24:
Pathways Professional Counseling is notifying affected patients of a data security incident that may affect the security of their protected health information. Pathways Professional Counseling and investigating authorities are unaware of any attempted or actual misuse of patients’ protected health information. Pathways Professional Counseling is providing notification to ensure that patients are aware of the incident so that they may take steps to protect their information should they feel it is appropriate to do so. Pathways Professional Counseling is providing one free year of identity monitoring and identity restoration services to affected individuals.
On September 24, 2015, a Pathways Professional Counseling employee had his Pathways Professional Counseling-issued laptop stolen from his vehicle. The laptop was password protected at the time of the theft. The theft of the laptop was discovered on September 25, 2015, and immediately reported to local law enforcement. This notice has not been delayed at the request of law enforcement. However, law enforcement is actively investigating this matter and Pathways Professional Counseling is cooperating in the ongoing criminal investigation. To date, there have been no arrests relating to the theft nor has the laptop been recovered.
Pathways Professional Counseling takes the security of information within its care very seriously. The employee reported the theft to Pathways Professional Counseling on September 25, 2015, and Pathways Professional Counseling immediately launched an investigation to determine the precise contents of the laptop, at the time of the theft. Pathways Professional Counseling also terminated the laptop’s network connection capabilities, changed the employee’s access credentials, and confirmed that our network systems were not accessed by the laptop since the employee’s last valid access the afternoon before the laptop was stolen. To assist in our investigation, Pathways Professional Counseling engaged independent third-party forensics experts to confirm the nature and scope of this incident.
Information Affected
While the investigations into this data security event are ongoing, Pathways Professional Counseling determined the security of some personal and protected health information relating to certain service recipients of Pathways Professional Counseling has been affected. The affected information includes an individual’s name combined with one or more of the following data elements: Social Security number, date of birth, address, treating physician name, diagnosis and clinical information, phone number, email address, demographic information, financial information, health insurance information, treatment information, and medication information.
Notification
Affected individuals for whom Pathways Professional Counseling has a valid postal address will be notified of this incident through U.S. mail. Information contained in the notice letter will also be available at http://www.pathwaysprofessional.org/. Pathways Professional Counseling is also disclosing this incident to the U.S. Department of Health and Human Services.
Identity Protection Services
As the investigations continue, and out of an abundance of caution, Pathways Professional Counseling is offering affected individuals access to a one-year membership to identity protection services, at no cost to the affected individuals. Notification letters to affected individuals contain enrollment instructions for these services.
[…]
Toll-Free Hotline
To better assist those who may potentially have been affected by this data privacy event, Pathways Professional Counseling has established a confidential, toll-free hotline to answer questions. The hotline is available Monday through Friday, 8:00 a.m. to 6:00 p.m. C.S.T. at (855) 770-0003. Please reference number 9538103015 when contacting the hotline.
****
Update Dec. 8: This incident was added to HHS’s public breach tool as impacting 986 patients.