Friend –

Last week, the ACLU of Alaska's Prison Project uncovered violations of the federal Health Insurance Portability and Accountability Act (HIPAA) by the Alaska Department of Corrections (DOC) through the electronic health record (EHR) system that DOC utilizes at facilities across the state.

The EHR system, TechCare, showcased the Protected Health Information (PHI) of at least 74 incarcerated Alaskans on its training website since at least November 30, 2023. The posted PHI includes diagnoses for mental health conditions, prescription medications and their dosages, and whether and when a patient began substance use treatment, among other information.

We notified both DOC and TechCare's parent software company, NaphCare, and also filed a complaint with the U.S. Department of Health and Human Services because of the gravity of the breach.

However, the response we got from NaphCare was surprising. The company claimed it did not violate HIPAA; it admitted to using real names of incarcerated Alaskans in its training program that is available publicly but stated that it used fake medical information on the website.

NaphCare's assertion that it hasn't published any true information – but has instead published false health care information about real Alaskans – is extremely troubling and should be of great concern.

The site was taken down quickly after we notified TechCare of the breach, but we are still pursuing our complaint with DHHS.

All Alaskans, even if they are incarcerated, are entitled to the privacy rights of protected health information.

We will continue to keep you updated on this issue as we ensure that the Department of Corrections upholds the constitutional rights of Alaskans in its custody.

ACLU of Alaska