HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Atmore Community Hospital Employee Inappropriately Accessed 1,000 Patient Records

A routine audit of PHI access logs has revealed that a former employee of Atmore Community Hospital in Alabama accessed the electronic health information of approximately 1,000 patients without authorization over a period of 13 months.

The audit was conducted by Infirmary Management Services, Inc, which manages the hospital. The privacy violations were discovered to have occurred between October 3, 2015 and November 11, 2016.

Fortunately, the information accessed was limited and no financial information, Social Security numbers or medical records were viewed, although the individual did view names of patients, their admission dates, and hospital flowsheets. Data access was permitted in order for the employee to complete work duties, but despite having received training on HIPAA Rules and hospital policies covering patient privacy, the individual viewed patients’ protected health information when there was no legitimate work reason for doing so.

The access is believed to have occurred out of curiosity and no information is thought to have been copied or distributed to any other individuals. Upon discovery of the privacy breach, the employee was placed on immediate leave and was later terminated.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

Due to the limited information that was accessed, patients are not believed to face an elevated risk of identity theft and fraud. All affected individuals have been notified of the breach by mail in accordance with Health Insurance Portability and Accountability Act Rules and have been instructed to monitor their finances and statements and to be vigilant for any sign of identity theft and fraud.

Each year there are many instances of healthcare employees violating patient privacy out of curiosity. All too often, these privacy violations are only identified many months after data have started to be inappropriately accessed. While it is not possible to eliminate the risk of privacy violations such as this entirely, healthcare providers can ensure that inappropriate PHI access is identified promptly by conducting regular audits of data access logs.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.