Two Valley Rehab Centers Report Patient, Worker Data Missing
Lebanon — Residents, patients and staff at two Upper Valley Genesis Rehabilitation Services centers were notified last month that a portable electronic storage device containing personal information had gone missing months earlier.
Genesis officials said that a USB flash drive containing personal data for more than 1,100 current and former residents had been missing since September, according to a news release distributed this week.
The device includes information ranging from clinical data to Social Security numbers for some of the 1,167 people who were at Lebanon Center, an in-patient rehab center, and Hanover’s Wheelock Terrace, an assisted living community between January 2008 and July 2013.
The company said it notified each staff member, patient, resident or guardian via letters mailed on Nov. 7.
There has been “no indication that the information on the USB has been improperly accessed or misused,” according to the release.
An investigation showed that data on the USB drive included current and former resident’s names, medical record numbers, dates of service and clinical data.
For the affected employees, the information stored on the drive included their names, street addresses or email addresses and Social Security information.
No credit card data or other financial information was stored on the drive, according to the release.
The Genesis company policy says “only encrypted USB data drives may be used,” meaning that data must be encoded in order to prevent unauthorized access. However, the missing device was not encrypted, according to the release.
Officials at the Lebanon rehab center deferred comment to the Pennsylvania headquarters. A Genesis spokeswoman declined to answer questions that were not addressed in the release.
“We complied with all state and federal regulations with respect to the timely notification of all patients and employees,” spokeswoman Jeanne Moore said in an email Wednesday evening. “In addition, a press release regarding the USB loss was made public. Yesterday, we learned that the press release may not have reached all targeted media outlets so the release was distributed.”
The drive was reported missing Sept. 3.
The release did not say when and where it was last located.
The incident was reported to the U.S. Department of Health and Human Services, as required by law. Following the incident, Genesis hired Kroll Inc., a risk consulting company, to operate a toll-free call center to address questions and provide identity-theft insurance to affected individuals.
Kroll is also providing free credit monitoring for 12 months and identity theft insurance.
The call center can be reached at 1-877-451-9362.
According to the release, the company is taking steps “to ensure that a similar situation does not recur,” including “immediate education” on the company’s policy requiring encrypted USB drives, continuing to encrypt and protect employee and resident data, and updating and spreading awareness of company policies and procedures on data security and privacy.
In Lebanon on Wednesday afternoon, patient-resident Deanna Vertone, who has lived at Genesis for three years, said she did not receive a letter about the data and therefore did not believe her information was on the drive.
However, she said she wished that the company had been more careful about protecting people’s personal information.
“That’s privileged information,” she said. “Just hope it doesn’t happen again.”
There are more than 80 residents at Wheelock Terrace and there are 110 beds at in Lebanon.
Maggie Cassidy can be reached at firstname.lastname@example.org or 603-727-3220.