LEHIGH

COUNTY

The County of Lehigh is making this disclosure in accordance with federal regulations, specifically 45 C.F.R. §§164.400-414.

On Dec. 6, 2019, in the course of a procurement for pharmacy services at Cedarbrook Senior Care and Rehabilitation, invoice information regarding resident prescriptions for the months of August, September and October of 2019, was inadvertently released by email to 16 pharmacy vendors participating in the bidding process for the contract.

The invoices included the names of Cedarbrook residents and all the medications the residents received for the period of time covered by the invoice. This occurred during a phase of the bidding process in which the pharmacy vendors used invoice information from the current contract to price out a new contract for the county.

Notification was sent to the pharmacy vendors within 24 hours of the release of this information instructing the vendors to delete those invoices. The county received written notification from all vendors within a week confirming the invoices were permanently deleted and not distributed to any others. These invoices were only sent to pharmacy vendors, who are aware of and normally bound by HIPAA and confidentiality regulations.

Affected individuals should not be at risk of further disclosure of their protected health information and need not take any other steps to protect themselves from potential harm.

For future procurement processes, all documents to be released in Cedarbrook procurements will be approved by the health information management officer prior to release to vendors bidding on county contracts.

Individuals who believe they may be affected by this breach may contact the health information manager at 1-800-743-9182.