California Correctional Health Care Services Data Breach Report

Incident Overview

On December 17, 2024, California Correctional Health Care Services (CCHCS) reported a data breach involving the loss of paper records and films containing protected health information (PHI) of 1,416 individuals. The breach was classified as a loss incident, meaning that physical documents and imaging materials were misplaced, lost, or otherwise became inaccessible to the organization. CCHCS, which provides medical services to California's incarcerated population across the state prison system, discovered that paper-based medical records and associated films (likely radiographic or diagnostic imaging materials) had been lost from their custody. This type of breach represents a significant vulnerability in physical information security practices, particularly within correctional healthcare settings where paper records remain a critical component of patient medical documentation.

Discovery and Response Timeline

The breach was identified and reported to the California Attorney General's office on December 17, 2024, triggering mandatory HIPAA breach notification requirements. While the specific discovery date is not detailed in the submission, the organization's prompt reporting indicates that internal audit procedures or inventory controls identified the missing records. CCHCS initiated an investigation to determine the scope of the loss, identify which individuals were affected, and assess what specific health information may have been compromised. The organization was required to notify affected individuals within 60 days of discovery, as mandated by the Health Insurance Portability and Accountability Act (HIPAA) Breach Notification Rule. Given the nature of a loss incident involving physical documents, the investigation likely focused on retracing the chain of custody for the affected records, reviewing access logs, and determining whether the materials were lost during transport, storage, or routine operations.

Breach Mechanics and Physical Security Context

Loss incidents involving paper records and films represent a distinct category of healthcare data breaches that differ from cybersecurity incidents. Unlike hacking or unauthorized digital access, physical loss breaches occur when tangible documents containing PHI are misplaced, abandoned, or otherwise removed from secure storage without authorization. In correctional healthcare settings, paper records may be lost during several common scenarios: transfer between facilities, movement to off-site storage, disposal procedures, or inadvertent abandonment in unsecured areas. Films, typically referring to radiographic imaging materials such as X-rays or CT scans, are particularly vulnerable because they are often stored separately from main medical records and may be transported for specialist review or archival purposes. The loss of these materials means that unauthorized individuals could potentially access sensitive medical information if the records are discovered in public spaces, sold, or otherwise exploited. Unlike digital breaches where access can sometimes be detected through system logs, physical loss breaches often go undetected for extended periods, making it difficult to determine exactly when or how the compromise occurred.

Organizational Context and Scope

California Correctional Health Care Services is a state agency responsible for providing comprehensive medical and mental health services to approximately 130,000 incarcerated individuals across California's 33 state prisons. CCHCS operates one of the largest correctional healthcare systems in the United States, managing thousands of healthcare workers, clinicians, and support staff across multiple facilities. The organization maintains extensive paper-based medical records systems alongside electronic health records, creating a complex information management environment. Correctional healthcare settings present unique challenges for information security because records must be maintained in secure facilities while remaining accessible to medical staff, custody personnel, and sometimes legal representatives. The distributed nature of California's prison system, with facilities spanning the entire state, increases the complexity of maintaining consistent physical security protocols across all locations. The loss of records from CCHCS represents a breach within a government healthcare entity serving a vulnerable population with significant medical and mental health needs.

Impact on Affected Individuals

Approximately 1,416 incarcerated individuals had their protected health information potentially compromised through this loss incident. The affected population includes individuals currently or recently incarcerated in California state prisons who had medical encounters documented in the lost paper records and films. For incarcerated individuals, a breach of medical records carries particular sensitivity because health information may reveal serious medical conditions, mental health diagnoses, disabilities, or treatment details that could affect their safety, housing assignments, or interactions with other inmates and staff. The loss of radiographic films is particularly concerning because these materials often document serious medical conditions requiring imaging studies, such as fractures, infections, or other significant health issues. Notification of affected individuals was required to be provided in writing, explaining the nature of the breach, the types of information involved, and recommended steps to protect themselves. For incarcerated individuals, notification may have been provided through institutional mail or in-person notification by healthcare staff.

HIPAA Compliance and Regulatory Requirements

Under the HIPAA Breach Notification Rule, any unauthorized acquisition, access, use, or disclosure of PHI that compromises the security or privacy of the information must be reported to affected individuals, the media (if more than 500 residents of a state are affected), and the Secretary of Health and Human Services. While this breach affected 1,416 individuals, it appears to have been reported to the California Attorney General rather than triggering national media notification requirements, suggesting the affected individuals may be distributed across multiple states or the breach was handled through state-level notification procedures. CCHCS was required to conduct a risk assessment to determine whether the lost records posed a significant risk of harm to affected individuals. Loss incidents involving paper records typically receive lower risk assessments than incidents involving digital theft or hacking, because the likelihood of the records being accessed or used maliciously is generally lower than with digital breaches. However, the assessment must still consider factors such as whether the records were found in public areas, whether they contained particularly sensitive information, and whether there is any evidence of unauthorized access or use. Physical loss breaches of this type are relatively common in healthcare settings; the American Medical Association and healthcare security organizations estimate that thousands of paper record loss incidents occur annually across U.S. healthcare facilities.

Recommended Mitigation Measures

Following this breach, CCHCS should implement enhanced physical security protocols for paper records and films, including improved inventory management systems, secure transport procedures, and regular audits of storage areas. The organization should consider transitioning to fully electronic health records to reduce reliance on paper-based documentation, though this represents a significant long-term investment. Staff training on proper handling and security of physical records should be mandatory and regularly updated. For affected individuals, while the risk of identity theft from medical records alone is generally lower than from breaches involving Social Security numbers or financial information, individuals should remain vigilant for any suspicious activity related to their medical care or identity.