HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Nurse Fired over Alleged Theft and Impermissible Disclosure of PHI

A former employee of a Germantown, MD-based healthcare provider is suspected of accessing the protected health information of up to 16,542 patients and providing that information to a third party for use in fraudulent activities.

On April 10, 2019, Takai, Hoover & Hsu, P.A., which runs THH Paediatrics in Germantown, was notified by county and state police that an individual had been arrested as part of an investigation in a matter unrelated to THH.

That individual was associated with an employee of THH who is suspected of accessing and impermissibly disclosing patient information including names, dates of birth, Social Security numbers, and addresses of the parents of patients.

Immediate action was taken by THH to investigate the allegations. Access to patient data was restricted for the employee, who was placed on leave on April 16 pending the outcome of the internal and law enforcement investigations.

Please see the HIPAA Journal Privacy Policy

The former employee has not been charged at this stage and no direct evidence has been found to suggest that any patient information was taken and misused; however, THH took the decision to fire the employee on May 3, 2019 after receiving further information from law enforcement. The matter has also been reported the Maryland Board of Nursing.

THH has hired a computer forensics company to conduct a detailed investigation of its computer systems to determine what, if any, protected health information has been accessed and whether information was copied.

Monroe County Hospital Notifies 10,970 Patients About PHI Breach at Navicent Health

Monroe County Hospital (MCH) in Forsyth, GA, is notifying 10,970 patients that some of their PHI may have been compromised in a security breach at one of its vendors.

On March 26, 2019, the hospital was informed by Navicent Health that some patient information was potentially compromised in a recent cyberattack. An unauthorized individual had gained access to the email accounts of several Navicent Health employees and potentially accessed MCH patient data. This was part of a much larger breach affecting more than 278,000 patients.

The forensic investigation revealed the following PHI may have been compromised: Names, addresses, dates of birth, medical record numbers, limited health information, and for certain individuals, driver’s license numbers or Social Security numbers.

All affected individuals were mailed notification letters on May 24.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.