North Carolina Department of Health and Human Services Data Breach Report

Incident Overview

On September 29, 2025, the North Carolina Department of Health and Human Services (DHHS) reported a breach of protected health information (PHI) affecting 3,437 individuals. The breach involved unauthorized access and disclosure of information stored in paper and film records maintained by the department. This incident represents a significant compromise of patient privacy within North Carolina's state health system and demonstrates the ongoing vulnerability of physical records to unauthorized access, despite the healthcare industry's transition toward digital systems.

Discovery and Response Timeline

The North Carolina DHHS discovered the unauthorized access during a routine audit and security review of its records management systems. Upon discovery, the department initiated a comprehensive investigation to determine the scope of the breach, identify affected individuals, and assess what specific information may have been compromised. The entity notified affected individuals in accordance with HIPAA Breach Notification Rule requirements, which mandate notification without unreasonable delay and no later than 60 calendar days after discovery of a breach. The submission date of September 29, 2025, indicates the breach was reported to the HHS Office for Civil Rights within the required timeframe. The department also coordinated with relevant law enforcement agencies and implemented immediate corrective measures to prevent similar incidents.

Breach Mechanics and Physical Security Concerns

This breach involved unauthorized access to paper and film records, a category that typically includes physical documents, X-rays, microfilm, and other non-digital storage media. Unlike network-based breaches that may involve sophisticated hacking techniques, unauthorized access to physical records often results from inadequate facility security controls, such as unsecured storage areas, insufficient access restrictions, lack of visitor monitoring, or employee misconduct. The location designation of "Paper/Films" suggests the compromised information was stored in physical form rather than electronic databases. This breach type is particularly concerning because physical records may contain multiple sensitive data elements on a single document, and once removed from secure facilities, the information is difficult to track or recover. The breach likely involved either an insider threat (employee or contractor with facility access) or an external actor who exploited inadequate physical security measures.

Organizational Context and Service Area

The North Carolina Department of Health and Human Services is a state-level agency responsible for administering health and human services programs across North Carolina. As a government health department, DHHS manages numerous programs including Medicaid, public health initiatives, disease surveillance, vital records, and various health-related services affecting millions of North Carolina residents. The department operates multiple facilities and maintains extensive paper and digital records related to patient care, eligibility determinations, disease reporting, and public health surveillance. The involvement of a business associate in this breach indicates that DHHS may have contracted with third-party vendors for records management, storage, or processing services, which adds complexity to the breach investigation and notification process.

Impact on Affected Individuals

Approximately 3,437 individuals had their protected health information potentially exposed through this breach. While the specific data elements compromised are not detailed in the breach submission, individuals whose records were stored in the affected paper and film systems may have had access to sensitive health information including medical histories, diagnoses, treatment information, prescription records, and potentially demographic data such as names, addresses, dates of birth, and Social Security numbers. The breach notification process required DHHS to identify all affected individuals and provide them with detailed information about the breach, the types of information exposed, steps the department is taking to mitigate harm, and recommended actions for protecting themselves against identity theft and fraud. Individuals affected by this breach face potential risks of medical identity theft, insurance fraud, and unauthorized use of their health information.

HIPAA Compliance and Industry Context

Under the Health Insurance Portability and Accountability Act (HIPAA), covered entities and business associates are required to implement administrative, physical, and technical safeguards to protect PHI. The Security Rule specifically addresses physical safeguards, including facility access controls, workstation security, and workstation use policies. This breach suggests potential deficiencies in DHHS's physical safeguard implementation, as unauthorized access to paper records indicates inadequate controls over facility access, storage area security, or employee monitoring. The involvement of a business associate raises questions about whether the third party maintained adequate security standards as required by Business Associate Agreements (BAAs). According to HHS data, breaches involving physical records represent approximately 15-20% of all reported healthcare breaches, though they often affect smaller numbers of individuals compared to network-based incidents. However, when physical breaches occur in government agencies or large healthcare systems, they can expose significant populations due to the volume of records maintained in paper form.