Atmore Community Hospital Employee Inappropriately Accessed 1,000 Patient Records
A routine audit of PHI access logs has revealed that a former employee of Atmore Community Hospital in Alabama accessed the electronic health information of approximately 1,000 patients without authorization over a period of 13 months.
The audit was conducted by Infirmary Management Services, Inc, which manages the hospital. The privacy violations were discovered to have occurred between October 3, 2015 and November 11, 2016.
Fortunately, the information accessed was limited and no financial information, Social Security numbers or medical records were viewed, although the individual did view names of patients, their admission dates, and hospital flowsheets. Data access was permitted in order for the employee to complete work duties, but despite having received training on HIPAA Rules and hospital policies covering patient privacy, the individual viewed patients’ protected health information when there was no legitimate work reason for doing so.
The access is believed to have occurred out of curiosity and no information is thought to have been copied or distributed to any other individuals. Upon discovery of the privacy breach, the employee was placed on immediate leave and was later terminated.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Due to the limited information that was accessed, patients are not believed to face an elevated risk of identity theft and fraud. All affected individuals have been notified of the breach by mail in accordance with Health Insurance Portability and Accountability Act Rules and have been instructed to monitor their finances and statements and to be vigilant for any sign of identity theft and fraud.
Each year there are many instances of healthcare employees violating patient privacy out of curiosity. All too often, these privacy violations are only identified many months after data have started to be inappropriately accessed. While it is not possible to eliminate the risk of privacy violations such as this entirely, healthcare providers can ensure that inappropriate PHI access is identified promptly by conducting regular audits of data access logs.
