HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Former Arkansas Children’s Hospital Employee Investigated Over Potential Theft of 4,500 Patients’ PHI

A former employee of Arkansas Children’s Hospital is being investigated by law enforcement over the theft and misuse of patients’ protected health information. According to the breach notice submitted to the Department of Health and Human Services’ Office for Civil Rights, the former employee potentially viewed and copied the PHI of up to 4,521 patients.

That individual was employed at Arkansas Children’s Hospital for 15 months between November 7, 2016 and February 6, 2018. During that time the employee was provided with access to patient health information to perform essential functions of the job.

On May 9, 2018, law enforcement notified Arkansas Children’s Hospital that an investigation had been launched over the possible theft of patients’ Social Security numbers and personal information and the misuse of that information for personal gain.

Arkansas Children’s Hospital immediately launched an investigation to determine the types of information that were potentially accessed and whether patients’ PHI had been accessed without authorization. While that internal investigation confirmed the types of information that were potentially accessed, it was not possible to determine whether the information was accessed for work purposes or other reasons.

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

Consequently, the incident has been treated as a data breach and all patients have now been notified of the possible theft and misuse of their PHI. The types of information potentially stolen includes full names, dates of birth, addresses, contact telephone numbers, Social Security numbers, health insurance information, charge amounts, descriptions of services received, and some clinical information.

As a precaution against identity theft and fraud, all 4,521 patients have been offered complimentary credit monitoring and identity theft protection services for 12 months. Patients have been advised to monitor their credit reports, financial statements, and Explanation of Benefits statements for any sign of fraudulent activity.

The employee has been terminated and Arkansas Children’s Hospital has now implemented additional hiring controls and has retrained its employees on internal policies and procedures and HIPAA Rules covering the accessing of patient information.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.