Media Release: Public Notice of Security Breach May 21

06-18-2010 (Dayton, OH) - On May 21, 2010, The Children’s Medical Center of Dayton was alerted that a mailing list containing 1001 patient names and addresses was improperly disclosed to another health organization. An investigation was launched and there is no indication the information has been misused in any way and Dayton Children’s has notified each of the patients or their guardians by letter.

After a thorough investigation, Dayton Children’s confirmed that an unencrypted list of patient names and addresses was sent via e-mail from the hospital to a local not-for-profit agency for use in a summer camp mailing. The list contained the names and addresses of patients who were treated in two clinics during a 15-month period. The information that was released did not contain any social security numbers, specific patient medical information, credit card or financial information or telephone numbers.

The investigation revealed that the breach was due to a human error and the information was not taken with criminal intent.

Dayton Children’s has confirmed that the list, which has been destroyed, was used for the exclusive purpose of inviting those listed to attend a summer camp; and the information was not shared or distributed to any other third-parties. As a result of this situation, Dayton Children’s has strengthened employee training on securing and protecting patient information.

“This is deeply distressing to us at Dayton Children’s because we take patient confidentiality very seriously and we will do everything we can to protect patient information,” David Kinsaul, the president and CEO of Dayton Children’s, wrote in the letter to those affected.

Dayton Children’s is committed to maintaining health information in a secure and confidential manner in accordance with federal and state law, and we regret that these standards were not met in this instance.

The notification of the families, the federal Department of Health and Human Services, the general public through this news release and a posting on the hospital’s website are made pursuant to the Health Information Technology for Economic and Clinical Health Act approved in 2009.

For more information, contact:
Betsy Woods
Public relations manager
Dyaton Children's
Phone: 937-641-3619
woodsb@childrensdayton.org