Public Notice of HIPAA Violation
March 30, 2021
RE: HIPAA BREACH
This letter is to inform you that there has been a HIPAA breach in 2020 between Mina Thevenin, LCSW, and Humana Tricare East. The breach affected all of my Tricare client was specifically targeted, but rather this is a crime of a check-cashing scheme.
WHAT DOES THIS MEAN FOR YOU?
If you were a Tricare client of mine in 2020, your PHI (Personal Health Information) that commonly appears on an EOB (Explanation of Benefits), like your name, your sponsor’s name, address, last four digits of sponsor’s I.D., dates of service, and your insurance “Out of Pocket Expenses to Date” amounts, were breached by a third party. No diagnosis nor complete I.D. numbers were disclosed (and are never disclosed) on the EOBs.
Your medical records per my practice at Mina Thevenin, LCSW, PLLC were not breached and they continue to remain secure. These records are never shared with Humana Tricare. (As for any medical record, it is only ever to be shared with another provider per your request and consent.)
WHAT HAPPENED?
On 03/12/2021, and 03/15/2021, I discovered a fraudulent check-cashing scheme that affected all of my 2020 Humana/Tricare billing. As the details of this discovery and investigations are still in process, it is evident that an unauthorized 3rd party changed my office location and billing addresses sometime in January 2020. The insurance claim checks and their attached EOBs were mailed to the fraudulent address at: 510 Spring Street, Jeffersonville, IN 47130. (The service location was fraudulently changed to: 1405 Browns Lane, Louisville, KY 40207.) Humana/Tricare has since confirmed that the checks were made out to me.
This 3rd party then forged my signature on the Humana/Tricare checks and cashed them. This breach and theft occurred to batch claims dated in April 2020, October 2020, and January 2021. I do not know what happened to the EOBs once the checks were cashed.
WHAT HAVE I DONE REGARDING THIS BREACH?
The breach of your PHI and rights under HIPAA means that this is a very serious situation. To date, the following are the actions I have taken:
- 03/12/2021 & 03/15/2021: Once I realized the breach and check-cashing scheme, I have requested to escalate Humana Tricare’s response to the breach. I am currently awaiting a response from an upper-level supervisor.
- 03/18/2021: *Reported the HIPAA violation to the DHA (Defense Health Agency) Privacy and Civil Liberties Office. Email: DHA.FOIA@mail.mil
- 03/18/2021: *Filed a breach report with the Secretary of HHS (Department of Health and Human Services for Civil Rights): Breach of Unsecured Protected Health Information, via the OCR website (Office for Civil Rights).
- 03/22/2021: *Filed a complaint with the FBI’s IC3 (Internet Crime Complaint Center) @ https://www.ic3.gov/Home/FileComplaint.
- 03/22/2021: Left a voice mail and detailed message with Humana Tricare Fraud department regarding these situations of concern. (Speaking with department live-personnel was not given as an option for this call.) 1-800-333-1620.
*No PHI or other identifiable information was used in any of the reports I have made.
WHAT ELSE WILL I DO?
- File a complaint with the Jeffersonville, Indiana police department against Steven R. Shelton, M.D. (He is owner of the business and building address: Park View Psychiatric Services, 510 Spring Street, Jeffersonville, IN 47130. Steve Shelton, M.D. was my previous employer from 1993-2004; I have not had any contact with him since I left his practice.)
- File complaints with both the Kentucky and Indiana Boards of Medicine against Steven R. Shelton, M.D.
- Phone meeting scheduled with Humana Military Fraud Department on 04/01/2021
- Waiting since 03/12/21, for Humana Tricare to send me a location affidavit to confirm my office/billing locations
Please contact me at my office (502) 814-3721 or my cell (502) 396-2675 if you wish to speak with me further about this breach of your PHI through Humana Tricare. You may want to follow-up with lodging your own inquiries and complaints; keep in mind that several of the reporting agencies have different time frames from discovery, from 180 days to one year.
Certified letters have been sent to clients whose HIPPA has been breached.
_____________________
I am truly sorry for this violation and the hardships it creates.
Just when we are all adapting to the new norm of the 2020’s pandemic and its unique caveats;
And as we are all challenged with personal stressors and goals;
We now have this!
I keep coming back to a little, but powerful prayer, as Paul writes in Romans 8:31:
If God is for us, who can be against us?
Sincerely,
_____________________________________________
Mina Thevenin, LCSW
NPI #1467473488