The Lake County Health Department mistakenly released personal health information of nearly 4,000 residents and staff of long-term care facilities.
3,815 long-term care facility residents and staff had their personal health information shared beyond their facility, officials said on Monday.
Between June 4 and August 18, the Lake County Health Department sent weekly reports of COVID-19 testing results to select contacts at long-term care facilities in Lake County, according to Hannah Goering, a spokesperson for the health department.
The facilities were part of a COVID-19 testing project designed to slow the spread of the coronavirus.
The weekly reports included names, dates of birth, addresses and COVID-19 testing status. They did not contain any Social Security numbers or financial information, Goering said.
The information was sent via encrypted email in filtered spreadsheets and the filter hid data from other facilities.
However, users could view the hidden information by changing the filter selection, Goering said. As a result, users could access the results from all facilities in the project.
The health department discovered the breach on September 10 and alerted the recipients and instructed them to delete the reports.
There is no evidence that any recipient misused the information, Goering said.
“The Lake County Health Department is committed to protecting personal information, and we have policies and procedures in place to protect your privacy. We have taken prompt action to prevent this from happening in the future. We deeply value the trust that our community places in us to provide quality care and services,” a statement from the health department said.
Anyone with questions or concerns is asked to contact the Lake County Health Department’s Privacy Officer at 847-377-8317, email firstname.lastname@example.org, or by mail to 3010 Grand Avenue, 2nd Floor, Waukegan, IL 60085.