The health data of thousands of NFL players may be compromised after a backpack containing paper and electronic medical records was stolen from an athletic trainer's car, reports Deadspin.
Deadspin obtained an email the NFL Players Association sent to every team's player representative on May 27 informing them of the theft. The email indicates the stolen backpack contained an unencrypted, password-protected laptop that had medical exam results for NFL combine attendees since 2004 and some Washington Redskins player records. The backpack also contained a zip drive and paper records of medical exam results for NFL combine attendees and current Redskins players.
The athletic trainer works with the Washington Redskins, but the stolen data likely includes information on thousands of players on various teams in the league, as the NFL combine is the league's annual scouting event. Records from the last 12 years will include those who currently or formerly played in the NFL, according to the report.
The email from the NFLPA says the association has consulted with HHS about the incident
The backpack was stolen April 15 in Indianapolis. A statement from the Redskins indicates no Social Security numbers or financial information was stolen or is at risk of exposure. The statement also said no protected health information under HIPAA was stolen or at risk of exposure, but HIPAA's definition of protected health information includes "individually identifiable health information," which includes common demographic data like names, birthdates and addresses. However, the NFL itself likely won't be deemed a covered entity under HIPAA, according to Deadspin, so the league may not be subject to any penalties from HHS.
A statement from the NFL said the league's EMR system was unaffected by this incident, and the league is working to notify any person whose information may be at risk.
More articles on data breaches:
Tumblr data breach affects nearly 66M users
Vendor breach exposes 87,000 Southeast Eye Institute patients' data
Healthcare breaches cost $2.2M: This and 7 more key findings on breaches in healthcare