HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Mississippi’s Magnolia Health Fires Employee for PHI Disclosure

Magnolia Health, a health insurance company serving Mississippi’s Medicaid population, has announced it has fired an employee for inappropriately accessing the protected health information (PHI) of “numerous Magnolia Health members” and disclosing those data to a relative.

The disclosure of PHI was against company regulations and the now former employee has not received authorization from the company or patients to share their data. The disclosure happened on two occasions: October 28, 2015., and November 8, 2015. The data were emailed from the employee’s work email account to a personal account and email account of a relative.

Upon discovery of the privacy breaches the Centene Corporation subsidiary conducted an investigation which resulted in the termination of the employment contract of the employee in question. Written statements were obtained from the employee and the recipient of the PHI stating they had not disclosed the data to any other individuals. Magnolia Health also viewed the personal email accounts of both individuals to confirm that all copies of the data had been deleted.

The data emailed from the employee’s account included the names of health plan members, their addresses and telephone numbers, dates of birth, Medicaid ID numbers, and Social Security numbers. No reason was given as to why the data were emailed to the relative.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

Magnolia Health has not disclosed how many individuals had their PHI compromised by the employee; however, the privacy breach was reported to the Mississippi Division of Medicaid. A breach report has not been added to the Department of Health and Human Services’ Office for Civil Rights breach portal. This suggests that the data breach affected fewer than 500 individuals. A substitute breach notice was posted on the Magnolia Health website on February 19, 2016.

All affected patients have been notified of the disclosure of their PHI and all have been offered a year of credit monitoring and identity theft protection services without charge.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.