Major data breach at Stanford Hospital
A spreadsheet containing personal data of 20,000 emergency room patients of Stanford Hospital appeared on Student of Fortune, a Web site which "crowdsources" homework to other students online. The lost data included names, admission dates, diagnoses and other sensitive information. According to the New York Times, the spreadsheet was uploaded to this site by a billings contractor of Stanford Hospital, when an employee tried to solicit help on how to create a graph from the data in the spreadsheet. As Gawker reasonably speculated, a contractor's employee probably did not know how to create a graph and "so uploaded it to the homework helper website and offered, probably, a buck or two if someone could do it for them."
This breach stands out among the hundreds of others not because of its size (significantly larger breaches have been reported to HHS in the last year alone), but because this breach went undetected for almost a year and because, once again, a contractor of the healthcare provider caused a major data breach. According to a privacy expert quoted in the Times, "nearly 20 percent of breaches involved outside contractors, accounting for more than half of all the records exposed," which is a staggering number.
To protect our healthcare provider clients, we always include specific privacy protection warranties, indemnification clauses and limitation of liability carve-outs for vendor's own negligent acts or omissions which result in a data breach or loss. Stanford Hospital's example illustrates that providers must insist on such protections despite strenuous objections from vendors because, otherwise, providers may be exposed to a wide range of expenses and damages from third-party claims, fines, investigations and breach notification associated with a data breach or loss resulting from vendor's actions.
The Times correctly pointed out that contract language alone is not enough, and that significant due diligence by each provider is required. Certainly, employee training for both the hospital and the business associate-type contractors is absolutely essential. Relating the seriousness and gravity of health information privacy breaches should be a key element of such training. However, having a clear termination right and a strong contractual obligation to indemnify the provider in the event a vendor causes a major breach like the one at Stanford Hospital, is a good start.
We frequently see vendor agreements either without such an indemnification clause or with severe caps on vendor's liability. The latter is often limited to one year's worth of fees, or, in a better scenario, all fees paid by provider to vendor under the agreement. However, in case of a major breach caused by a vendor, such caps would not allow a provider to recover its costs and damages in dealing with the breach. Therefore, carve-outs to vendor's limitation of liability in connection with vendor's own breaches of PHI or other confidential information are crucial.
Stanford Hospital may be exposed to significant fines under both federal and state privacy laws. In fact, another Stanford hospital (Packard Children's) was slapped with a $250,000 fine under California law for failing to report a breach within 5 days. However, such regulatory expenses are just the tip of the iceberg: Stanford Hospital will have to spend a lot more on investigations, legal expenses, staff time, and, possibly, credit monitoring for the affected individuals.
For more information, please listen to or view the slides from our Webinar on negotiating "must-have" provisions in HIT contracts.
"Patient Data Posted Online in Major Breach of Privacy," The New York Times (September 8, 2011).
"Stanford Hospital Suffers Comically Stupid Patient Data Leak," Gawker.com (September 8, 2011).
Our own Steve Fox was interviewed by 