State mental health hospital in Pueblo experiences potential data breach

Hide Featured Image

April 7, 2020 (PUEBLO) — The Colorado Mental Health Institute at Pueblo (CMHIP) experienced a potential data breach after finding a folder containing protected health information on a shared internal drive. The state-run hospital is part of the Colorado Department of Human Services, Office of Behavioral Health (OBH).

On January 31, CMHIP staff identified the file containing protected health information on a shared internal drive and immediately took steps to mitigate harm. A forensic investigation by the Colorado Office of Information Technology found that some personal information was accessible to all CMHIP staff while the file was on the drive instead of only to providers who required the information to perform their job. The investigation determined that at no time was information publicly accessible, and there is no evidence that any information was viewed, acquired or used improperly by CMHIP staff. 

The possible exposed personal information included demographic, financial and clinical information. Demographic information includes name, date of birth, Social Security number, address, and other demographic details. Financial information includes claim and insurance information. Clinical information includes admission dates, discharge dates and competency evaluations and possibly diagnosis and treatment information.

CMHIP and OBH’s Forensic Services are sending letters to all affected individuals and working to implement new technical safeguards in the Office of Information Technology, review and revise policies and procedures, and provide additional training for CMHIP and Forensic Services staff. 

To protect themselves from potential harm resulting from the breach, those affected may request a free copy of their credit report from Experian, TransUnion or Equifax and review the Colorado Attorney General’s fraud prevention resources. Individuals may also file a complaint with the Office for Civil Rights in the U.S. Department of Health and Human Services. For more information, those affected may call 1-833-870-1201. 

CMHIP is a 449-bed forensic and civil bed hospital. The hospital primarily serves individuals with pending criminal charges that require competency evaluations; individuals who have been found by a court to be incompetent to proceed, known as restoration treatment; and individuals found to be not guilty by reason of insanity. 

OBH’s Forensic Services unit coordinates, manages and responds to court orders for forensic evaluation and related forensic services statewide.

Madlynn Ruble
Deputy Director of Communications