HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Our Lady of the Angels Hospital Breach Impacts 1,140 Patients

Our Lady of the Angels Hospital has discovered a former employee accessed the medical records of 1,140 patients without authorization.

The employee had been granted access to the protected health information in order to conduct work duties; however, hospital staff became aware the employee was accessing medical records without any legitimate work reason for doing so.

The improper access was discovered on July 25, 2017, and the employee’s access to the medical record system was immediately terminated, as was the employee.

Rene Ragas, President and CEO, Our Lady of the Angels Hospital, said, “Patient privacy is a top priority and we have a zero-tolerance policy for employees who improperly access patient data.”

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

A thorough investigation was conducted to determine which patients had been impacted, which revealed the former employee had been inappropriately accessing the medical records of patients for more than three years.

The Bogalusa, LA hospital was acquired by the Franciscan Missionaries of Our Lady Health System on March 17, 2014, which is the date given for when the improper access first started. A spokesperson for the hospital confirmed to Becker’s Hospital Review that the improper access may have been occurring for up to 15 years, when the hospital was managed by LSU Health under the name LSU Bogalusa Medical Center.

The employee was questioned about the improper access and it does not appear that any patient health information was shared with any other individuals or was used improperly. This appears to be another case of a healthcare employee accessing medical records out of curiosity.

Even though data theft and misuse is not suspected, out of an abundance of caution, all patients whose privacy was violated have been offered 12 months of credit monitoring services without charge.

The types of information accessed by the former employee includes names, addresses, phone numbers, dates of birth, gender, insurance information, social security numbers, diagnoses, dates of services, places of services, and clinical information such as orders, test results, medications, and clinical abstracts.

Our Lady of the Angels Hospital is reviewing policies and procedures and will be revising its audit processes to ensure any future privacy breaches of this nature are identified more rapidly. Additional training is also being provided to employees regarding the privacy and security of PHI.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.