Breach Overview

Northwest Health – La Porte, a healthcare facility located in Indiana, experienced an unauthorized access and disclosure incident involving patient records stored in paper and film formats. The breach was reported to the U.S. Department of Health and Human Services on May 2, 2023, affecting 10,256 individuals. This incident represents a significant compromise of protected health information (PHI) maintained by the organization, requiring immediate notification to affected patients and regulatory authorities under HIPAA Breach Notification Rule requirements.

Discovery and Response Timeline

While specific discovery details were not provided in the breach submission, Northwest Health – La Porte initiated an investigation upon identifying the unauthorized access to paper and film records. The organization's response included a comprehensive review of affected records, determination of the scope of exposure, and preparation of breach notifications required under 45 CFR §164.400-414. The May 2, 2023 submission date indicates the organization met the 60-day notification requirement established by HIPAA regulations, suggesting the breach was likely discovered in early March 2023 or earlier. The organization worked to identify all individuals whose information may have been compromised and prepared individualized notification letters detailing the nature of the breach and recommended protective measures.

Nature of the Breach

The breach involved unauthorized access to and disclosure of patient information maintained in physical formats—specifically paper records and medical films. This type of breach typically occurs through several potential vectors: physical theft of records from unsecured storage areas, unauthorized access by employees or contractors with facility access, loss of records during transport or storage transitions, or discovery of records in unsecured locations following facility reorganization or renovation. Paper and film-based breaches differ from digital breaches in that they often involve physical security failures rather than cybersecurity vulnerabilities. The fact that no business associate was involved suggests the breach occurred within Northwest Health – La Porte's own facilities or under their direct control, rather than through a third-party vendor or service provider. The scale of 10,256 affected individuals indicates this was not an isolated incident but rather a systematic exposure affecting a substantial portion of the organization's patient population.

Organizational Context

Northwest Health – La Porte operates as a healthcare facility in La Porte County, Indiana, serving the local and regional community. The organization provides inpatient and outpatient services typical of a community hospital or health system. The presence of both paper records and medical films in their systems suggests a healthcare facility that maintains traditional medical record-keeping practices alongside or in transition from older documentation methods. The scale of the breach—affecting over 10,000 patients—indicates this is a substantial healthcare provider serving a significant patient population. The organization's location in Indiana places it under Indiana state law requirements in addition to federal HIPAA regulations, potentially triggering additional state-level breach notification requirements under Indiana Code §24-4.7-2.

Patient Population Impact

Approximately 10,256 patients of Northwest Health – La Porte had their protected health information exposed through this unauthorized access incident. This represents a substantial portion of the organization's active patient base and indicates the breach affected records across multiple patient populations and service lines. Patients who received care at the facility during the period when records were vulnerable to unauthorized access may have been affected. The breach notification process required the organization to contact each affected individual with specific information about what data was compromised, the date range of potential exposure, and recommended actions to protect themselves from potential misuse of their information.

HIPAA Compliance and Regulatory Context

Under the HIPAA Breach Notification Rule, any unauthorized access or disclosure of unsecured PHI affecting more than 500 residents of a state or jurisdiction requires notification to prominent media outlets in addition to individual notifications. With 10,256 individuals affected, this breach clearly exceeded the 500-person threshold, likely triggering media notification requirements. Healthcare organizations are required to conduct a risk assessment to determine whether a breach of security has occurred, considering factors such as the nature and extent of the PHI involved, who accessed the information, whether the information was actually acquired or viewed, and the extent of mitigation measures implemented. Breaches involving paper records and films represent a persistent vulnerability in healthcare settings, as physical security controls are sometimes less rigorously maintained than digital security measures. Industry data indicates that unauthorized access and disclosure incidents account for a significant portion of healthcare breaches, particularly in smaller and mid-sized healthcare facilities where comprehensive physical security protocols may not be fully implemented.