Hospital Employee Discovered to Have Improperly Accessed 6,200 Patient Records
Covenant HealthCare has notified more than 6,000 patients that their electronic medical records were inappropriately accessed by one of its employees.
The improper access was discovered during a November 2016 audit of EMR access logs. The audit revealed an unusual pattern of medical record access by a single employee. Covenant HealthCare immediately ordered a full review of ePHI access by the employee to determine which medical records had been accessed and whether there was any legitimate reason for those records to have been viewed.
The review revealed that the Covenant HealthCare employee first started improperly accessing its electronic medical record system on February 1, 2016. The improper access continued for nine months until November 21, 2016 and involved 6,197 patients. A range of data were potentially viewed including patient’s names, dates of birth, home addresses, health insurance information, diagnostic and treatment information, medical record numbers, Social Security numbers and driver’s license numbers.
Covenant HealthCare spokesperson Kristin Knoll said in a statement that an investigation into the HIPAA breach was immediately launched and resulted in termination of the employee. Knoll also confirmed that the breach has been reported to all appropriate agencies.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Affected patients have now been notified of the breach by mail, although the delay in issuing notifications was because Covenant required two months to complete its investigation.
No reports of misuse of patients’ information have been received to date by Covenant HealthCare. All patients who have had their Social Security numbers viewed will be offered free credit monitoring and protection services to mitigate risk.
To prevent future breaches of this nature, Covenant HealthCare has increased ongoing training on patient privacy. Audits of ePHI access logs will also be conducted more frequently to ensure that any future inappropriate access is identified promptly.
