Claxton-Hepburn Medical Center Fires Several Employees for Inappropriate PHI Access
Claxton-Hepburn Medical Center, a not-for-profit 115-bed community hospital in Ogdensburg, NY, has fired several employees for accessing patient health records without authorization.
The PHI breaches were discovered during an internal investigation. It is unclear whether that investigation was launched following a complaint that had been received or if the patient privacy violations were uncovered during a routine audit of PHI access logs – A requirement of HIPAA.
Claxton-Hepburn Medical Center has not publicly disclosed how many employees were terminated over the violations, only reporting that all employees who purposely committed the acts were terminated. It is also currently unclear exactly how many patients’ PHI was breached.
Claxton-Hepburn Medical Center has confirmed that training is given to all employees on the first day of employment detailing the requirements of HIPAA and the importance of protecting the privacy of patients. All employees are made aware that accessing patient health information is only permitted when PHI needs to be viewed to complete work duties or when patient records need to be updated, as per the requirements of the HIPAA Privacy Rule. Employees are also made aware that any unauthorized accessing of PHI will result in disciplinary action. It would have been clear to the employees concerned that their actions were in violation of HIPAA Rules.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The discovery of the privacy breaches has prompted the hospital to implement further safeguards to reduce the likelihood of future HIPAA violations of this nature occurring. Claxton-Hepburn Medical Center has also notified all patients by mail whose records were inappropriately accessed.
While it is possible for criminal charges to be filed against healthcare employees for HIPAA Privacy Rule violations, in this instance Claxton-Hepburn Medical Center has not involved the police.
