PHI Data Breaches Just Went From Bad Dream To Nightmare In West Virginia

The dreaded PHI data breach is every covered entity's bad dream, but the West Virginia Supreme Court just turned that bad dream into a nightmare. The court decided a case, Tabata v. Charleston Area Medical Center, Inc., brought on behalf of thousands of patients requesting class certification to sue the medical center for breaching their privacy rights. The patients alleged that the medical center was responsible for placing their personal and medical information on an electronic database and website, which was accessible to the public. This database included names, contact details, Social Security Numbers, and dates of birth of 3,655 patients, along with certain basic respiratory care information. The breach was also an apparent HIPAA violation and was reported by the Center on the "Wall of Shame" website for reporting HIPAA data breaches involving more than 500 individuals. A business associate, Xforia Web Services, was also reported on the website as having been