A Health Information Breach Feared by Alabama’s Surplus Rehab Equipment

The Alabama Department of Rehabilitation Services is advising the public of a possible personal information breach related to equipment used by the Children’s Rehabilitation Service (CRS).

ADRS became aware last November of a breach in three surplus hearing screening devices that had previously been used for pediatric screening referrals. Devices help determine the type of hearing services needed.

The devices had previously been used by CRS – one in Montgomery and two in Huntsville. After they were used, they were sent to the Surplus Assets Division of the Alabama Department of Economic Development and Community Affairs (ADECA) and sold.

The device once used in Montgomery was purchased by an Alabama audiologist who found the personal information still on the device and immediately contacted CRS to report and return it. The other two hearing screening devices, used by the CRS office in Huntsville between 2007 and 2013, are under investigation.

State officials with CRS believe the risk of identity theft is extremely low, as none of the devices contained social security numbers or home addresses. The device information included the child’s name, gender and date of birth, mother’s name, caregiver’s name and hearing screening results, which were pass, fail, retry or incomplete.

ADRS directly notified the families of children who were affected in the Montgomery area by letter and provided resources and recommendations to better protect the information.

ADRS will continue to investigate the two devices used in Huntsville and will follow the same protocol in notifying the families involved. ADRS has notified the US Department of Health and Human Services, as required by federal law, and is working to ensure that protected information is erased from all devices in the future.

Comments are closed.