HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Hospital Employee Discovered to Have Improperly Accessed 6,200 Patient Records

Covenant HealthCare has notified more than 6,000 patients that their electronic medical records were inappropriately accessed by one of its employees.

The improper access was discovered during a November 2016 audit of EMR access logs. The audit revealed an unusual pattern of medical record access by a single employee. Covenant HealthCare immediately ordered a full review of ePHI access by the employee to determine which medical records had been accessed and whether there was any legitimate reason for those records to have been viewed.

The review revealed that the Covenant HealthCare employee first started improperly accessing its electronic medical record system on February 1, 2016. The improper access continued for nine months until November 21, 2016 and involved 6,197 patients. A range of data were potentially viewed including patient’s names, dates of birth, home addresses, health insurance information, diagnostic and treatment information, medical record numbers, Social Security numbers and driver’s license numbers.

Covenant HealthCare spokesperson Kristin Knoll said in a statement that an investigation into the HIPAA breach was immediately launched and resulted in termination of the employee. Knoll also confirmed that the breach has been reported to all appropriate agencies.

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

Affected patients have now been notified of the breach by mail, although the delay in issuing notifications was because Covenant required two months to complete its investigation.

No reports of misuse of patients’ information have been received to date by Covenant HealthCare. All patients who have had their Social Security numbers viewed will be offered free credit monitoring and protection services to mitigate risk.

To prevent future breaches of this nature, Covenant HealthCare has increased ongoing training on patient privacy. Audits of ePHI access logs will also be conducted more frequently to ensure that any future inappropriate access is identified promptly.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.