It took the Center for Health Care Services a year and a half to realize a former employee had swiped social security numbers and sensitive mental health records for 28,434 patients before leaving.
According to CHCS, Bexar County's mental health authority, the employee was fired on May 31, 2016. When he left, the employee allegedly took the patient data with him on his personal laptop. But CHCS officials only learned of the stolen records in early November 2017, from documents linked to some type of undisclosed legal case between the former employee and the health center. CHCS hasn't said why the employee was fired.
These records include — but are not limited to — the names, addresses, social security numbers, substance abuse treatment plans, referral information, progress notes, diagnoses, medications, lab and toxicology reports, autopsy reports and death certificates of thousands of CHCS patients.
But the clinic doesn't seem too concerned.
“There is no evidence to indicate that the information has been distributed outside of this group,” CHCS wrote in a news release Friday. “Attorneys for CHCS are seeking a protective order to prevent further disclosure of the information, and to verify deletion of the information as soon as the court permits.”
It should be noted that CHCS patients are already an especially vulnerable population. The county center is the main place homeless residents are sent for mental health and substance abuse treatment. It helps connect criminal offenders to psychiatric and drug abuse help in hopes of diverting them from future arrests. It specifically helps low-income veterans with Post-Traumatic Stress Disorder (PTSD) or military sexual trauma, addiction, mental illness or other disorders. It offers free HIV testing, health care geared toward foster children, and intervention services when the cops are called on someone having a mental health crisis.
These are just a sampling of what kind of sensitive records the former employee has had access to for 17 months.
CHCS is now in the process of informing more than 28,000 patients that this kind of information about them is unprotected.