Report: Thousands of NFL medical records stolen

The NFL recently informed its players that a theft in late April exposed healthcare records for thousands of them, including attendees of the annual scouting combine from the last 13 years, Deadspin reported Wednesday.

Someone broke into the car of a Washington Redskins athletic trainer, stealing a backpack that contained a laptop with copies of medical exam results for attendees from 2004 to the present, as well as other player records. The laptop was password-protected but unencrypted.

{mosads}The backpack also contained an external hard drive and some paper records of combine medical exams and “portions” of current medical records for Redskins players, according to a letter sent to the players union on May 27.

Combine attendees from the last 13 years would include the majority of NFL players, potentially making the theft a major violation of the Healthcare Portability and Accountability Act (HIPAA).

The Department of Health and Human Services (HHS) has vigorously pursued “covered entities,” organizations responsible for guarding the privacy of medical records, that allow data thefts. Fines for violations can range into the millions of dollars.

There has been some debate over whether athlete medical records should be subject to the same protections as non-athletes, with the NFL arguing that they should be classified as employment records.

The agency cautioned that an athletic trainer may not be liable under the law. 

An athletic trainer could only be covered by HIPAA if they are billing insurance companies for the services they are providing, Deven McGraw, the deputy director of health information privacy at HHS’s Office for Civil Rights told The Hill. It is not clear that they would be doing so if they are employed by a team, McGraw said. 

The agency has warned that encrypting devices is a necessary security precaution.

The letter from NFL players union Executive Director DeMaurice Smith directs inquiries to the Redskins and NFL lawyers.

–Updated Monday, 1:12 p.m.