PHOENIX — Medical information for some Arizona inmates that should be private was recently found online.
The ACLU reported the problem after saying they observed private medical information for inmates in Arizona listed on a manual through the website for contracted healthcare provider, NaphCare.
Some of the details that were public, according to the ACLU, include diagnoses, prescription medications, and immunizations.
As of August, there were more than 35,000 people incarcerated in Arizona’s prison system.
In a letter to the state corrections department and NaphCare, the ACLU alleges as many as 54 incarcerated or formerly incarcerated people in Arizona had their private information posted online and that the company was violating HIPPA.
"It's just a gross invasion of people's privacy," said Corene Kendrick, with the ACLU National Prison Project.
A NaphCare spokesperson told 12News that they "initiated an investigation and determined a section of a training manual...was made public, mistakenly."
The manual on the website is no longer publicly available.
The NaphCare spokesperson also said that of the 54 people identified by the ACLU, 10 included limited health data. 40 were public non-health information like names and prison housing; and 4 were test records, not representing actual patients.
A spokesperson for the Arizona Department of Corrections, Rehabilitation and Reentry, or ADCRR, said they were also looking into the matter.
This isn’t the first time prison healthcare has been under the microscope.
ADCRR has been involved in a federal lawsuit since 2012, where a judge found violations of prison mental and physical healthcare.
The corrections department is currently under a court order to fix the problems but continues to miss court-imposed benchmarks. Some of that is reportedly due to issues with staffing from NaphCare.
As for the medical information found online, the ACLU said it also alerted the federal Department of Health and Human Services. That department has not yet confirmed whether it will investigate.
The full statement from a NaphCare spokesperson is below:
NaphCare takes the privacy of our patients and the security of their health information very seriously.
Following a report that patient health information may have been publicly accessible, we initiated an investigation and determined a section of a training manual for our electronic health record system was made public, mistakenly. NaphCare took immediate action to secure the exposed content and disable public access to training materials. The training materials contained screenshots that displayed limited information for some actual patients.
Of the 54 records identified by the ACLU as possibly exposed, our initial investigation found that only ten records were actually impacted.
- 4 were test records, not representing actual patients
- 40 disclosed only publicly accessible, non-health information, such as name and housing location
- 10 included limited health-related data
Moving forward, we are taking steps to ensure strict compliance with policy and procedures. NaphCare remains steadfast in our commitment to continuously strengthening our security protocols to effectively safeguard patient data.
Up to Speed
Catch up on the latest news and stories on the 12News YouTube channel. Subscribe today.