Thielen Student Health Center (TSHC) experienced a data leak where inadvertently disclosed student information could be seen.

Erin Baldwin, director of Thielen Student Health Center said on Nov. 5 the TSHC experienced a breach in their system when a coding error occurred as they put student information into a system to be sent out as patient satisfaction survey.

Over the past three years, more than 100,000 patient satisfaction surveys have been sent out, and this is the first major error that has occurred.

“Six-hundred out of 100,000 is a small number, but we would rather it be zero,” Baldwin said

The error enabled some 600 patients to see “the name of another patient, the date of their appointment and the provider they would have seen,” Baldwin said.

All of the information was kept internal, no sources outside of the patients or the university could see any patient information.

The breach was seen within an hour and Baldwin said TSHC “shut down the patient satisfaction survey and [they] were able to recall a large number of the satisfaction surveys so that information was not shared.” She also emphasized that no social security numbers, student ID numbers, diagnoses, medications or clinical information was shared.

As a part of their commitment to their patient privacy policy the health center sent out individual notices to each of the students explaining the error and what happened. In addition, the health center published ads explaining what happened, said Brett Lohoefener, associate council to the university.

“We never want this kind of error to occur,” Baldwin said.

TSHC is committed to giving the best care possible to the students of Iowa State, and since Baldwin became director many improvements have been made. One of which Baldwin mentioned was phone calls to the health center. Baldwin said three years ago a student could have been placed on hold for up to 20 minutes.

Through student feedback and prioritizing top concerns, a phone call nowadays is answered typically within 20 seconds. This is why the patient satisfaction surveys are important to the health center, Baldwin said.

To prevent a situation like this from happening again, TSHC is going to change the survey process so there will be a different sorting process for patient data.

“When it is put into the survey software… [they] will take off personally identifiable information,” Baldwin said.

Within the ads sent out by the health center they urged patients to contact the Thielen Student Health Center with any questions.

“We really value the privacy of our patient’s information,” Baldwin said. “People put a lot of trust in us at the health center … so we really want to honor that trust and apologize for this breach and reassure everyone that we put safeguards in place to prevent this from happening in the future.”

The suggested contact information provided was their phone number: 515-294-5802; email: [email protected]; website: www.cyclonehealth.org; or via mail at 2647 Union Drive, Ames, IA 50011.