HOUSTON — Several prominent Houston-area hospitals are notifying patients about a breach after medical records were found scattered on a sidewalk in Midtown by a KHOU 11 employee.
KHOU 11 News launched an investigation after discovering the hundreds of documents contained private information that included patients’ names, dates of birth, diagnoses, treatment, medication lists, vital signs and admission dates.
The records involve approximately 1,800 patients of MD Anderson Cancer Center, LBJ Hospital, Memorial Hermann Hospital, Children’s Memorial Hermann, and TIRR Memorial Hermann.
The records were stolen from the trunk of a medical resident’s locked vehicle in July, according to officials with UTHealth.
The recent graduate didn’t notify police about the burglary until after a KHOU reporter contacted him.
He had studied at UTHealth’s McGovern Medical School and had worked at MD Anderson, LBJ, Memorial Hermann, Children’s Memorial Hermann and TIRR.
It’s not clear how or why a resident would take medical records out of the hospitals.
“We promptly took steps to investigate the circumstances of the disclosure, which revealed that the stolen documents had been discarded on a city street and found a day later by an employee of KHOU-TV Channel 11,” UTHealth said in a statement. “We have no evidence that the patient information was used or viewed between the theft and the recovery.”
Lisa Cotrone, 37, is one of the patients whose information was found in the papers strewn on the street.
She was treated at Memorial Hermann Hospital after a horrific car crash four years ago. She suffered organ failure, broken bones and a traumatic brain injury.
“I don’t remember anything, nothing,” Cotrone told us.
But her mother will never forget.
“Her lung collapsed, and they were filling up with blood. She wasn’t breathing. She ended up having a stroke in the helicopter on the way downtown,” Diane Cotrone said.
Learning her daughter’s medical records were so carelessly discarded was disturbing, to say the least.
“For someone to be this careless with all these papers, not just one or two, but stacks of papers. That’s not good,” Diane Cotrone said.
KHOU reached out to a handful of patients as part of the investigation. Several wanted to share their frustration about the privacy breach.
“It should never have gone home. It should never have been left in somebody’s car. It should have stayed at the hospital. At the school or at the hospital,” said a Houston-area woman whose husband was treated at MD Anderson. She asked not to be identified. “My husband passed away this year. To find out his medical records were laying on the side of the street, it makes me feel almost like he has been violated and he isn’t here to defend himself.”
In a statement, UTHealth said the hospitals involved are sending letters to patients who are impacted by the breach.
KHOU 11 News returned the original medical records to UTHealth so they could report the HIPAA breach to the government and notify the hospitals.
KHOU reached out to those hospitals. MD Anderson, Memorial Hermann Health System and Harris Health System – which owns LBJ -- issued statements emphasizing the importance of protecting the privacy of their patients. You can read the full statements here:
Patients who would like more information should contact the UTHealth Privacy Office at 713-500-3391 or 1-888-472-9868, or email privacy@uth.tmc.edu.