Health clinic looted after Durham gas explosion reports patient files data breach
A Durham health clinic forced to relocate after the April 10 downtown gas explosion says patient data, including diagnosis and treatment information, may have been breached after looters broke in and stole laptops and other items.
Employees of Main Street Clinical Associates, which provides mental health services, had to immediately evacuate during the incident, leaving patient files open and a file room unlocked, according to a notice on the clinic’s website.
The clinic, at 115 N. Duke St., was located near Kaffeinate Coffee Shop, Prescient Co. and The Ingram Collection, which were destroyed in the blast after a contractor laying fiber hit a gas line.
Two people died. Twenty-five others were injured. A total of 23 businesses in 18 buildings were affected by the explosion that caused more than $100 million worth of property damage.
Damage to the clinic’s building prevented employees from returning until Sept. 9.
“Main Street discovered that looters had unlawfully entered the office and stolen two laptop computers, a clinician’s cell phone, and a printer that stored patient information,” the notice states.
The phone and computers were password protected, along with the client files stored on them.
Officials believe the theft occurred between July 15 and Sept. 9.
Patients’ names, driver’s license numbers, Social Security numbers, health insurance information, diagnosis and treatment information may have been accessed or acquired by an unauthorized individual, the clinic’s notice states.
The notice did not say how many people might be affected.
A reporter contacted the clinic, which has moved to 3326 Durham-Chapel Hill Blvd., and was referred to attorney Chris DiIenno. DiIenno said clinic officials understood the area was secured by authorities and weren’t let back on the property. .
Durham Police Department spokesperson Kammie Michael said no arrests have been made and no other businesses reported similar break-ins.
After Main Street officials discovered the theft, the company reported it to police, changed passwords and remotely monitored suspicious activity on the devices, the notice states.
“The investigation into whether the devices have been accessed without authorization is ongoing,” the notice states.
Steps those potentially affected by the data breach can take to protect against identity theft and other issues include monitoring their accounts and credit reports and asking credit bureaus to place a fraud alert that requires additional verification before credit is granted in their name.
Individuals seeking more information regarding this incident should call 866-775-4209 from 9 a.m. to 6:30 p.m. Monday through Friday.
This story was originally published November 19, 2019 at 1:01 PM.
