Alaska prison contractor now says leaked inmate names were real — but medical data was fake

The prison contractor accused of displaying the confidential health information of dozens of Alaska inmates on a public website now says the names were real, but the diagnoses were fake.

On Tuesday, the ACLU of Alaska said it had uncovered what it called a “massive” health privacy law violation, with the full names of 74 inmates along with sensitive information such as mental health diagnoses, medications and other legally protected personal information apparently published on a training website of DOC’s electronic records contractor and available to anyone with an internet connection.

NaphCare, the Alabama-based prison health care giant, fired back in a statement on Tuesday, saying the ACLU of Alaska’s assertions were “false and misleading.”

The company said that a training manual had been mistakenly made public online.

“NaphCare took immediate action to secure the exposed content and disable public access to training materials,” a company spokesperson wrote in a statement. “The training materials contained screenshots that displayed Alaska DOC patient names with fictitious health-related information for internal training purposes.”

Therefore, “no health-related patient data was exposed publicly by NaphCare.”

The ACLU of Alaska said it hadn’t been contacted by NaphCare as of Wednesday afternoon.

Incarcerated people’s real names being published with “allegedly fictitious medical statements” is a problem of its own, ACLU spokesperson Meghan Barker said in a statement.

“Everyone in Alaska, including incarcerated people, is entitled to the privacy of personal health information. NaphCare’s assertion that it hasn’t published any true information — but has instead published false health care information about real Alaskans — is extremely troubling and should be of great concern,” said Barker.

When asked why NaphCare used real patient names and then populated fake medical information for training rather than using all fictional information, the company responded that it is a “common practice.”

“Patient demographic information that is publicly available is used to create empty patient records,” the company said. “Fictitious health data is manually entered by non-healthcare staff in order to provide a near-production environment, without risking actual patient data.”

It’s not clear whether any of the Alaska inmates whose names and supposed mental and physical health diagnoses were on the internet know about it. Most Alaska prisoners don’t have access to the internet.