Our Lady of the Angels Hospital Breach Impacts 1,140 Patients
Our Lady of the Angels Hospital has discovered a former employee accessed the medical records of 1,140 patients without authorization.
The employee had been granted access to the protected health information in order to conduct work duties; however, hospital staff became aware the employee was accessing medical records without any legitimate work reason for doing so.
The improper access was discovered on July 25, 2017, and the employee’s access to the medical record system was immediately terminated, as was the employee.
Rene Ragas, President and CEO, Our Lady of the Angels Hospital, said, “Patient privacy is a top priority and we have a zero-tolerance policy for employees who improperly access patient data.”
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
A thorough investigation was conducted to determine which patients had been impacted, which revealed the former employee had been inappropriately accessing the medical records of patients for more than three years.
The Bogalusa, LA hospital was acquired by the Franciscan Missionaries of Our Lady Health System on March 17, 2014, which is the date given for when the improper access first started. A spokesperson for the hospital confirmed to Becker’s Hospital Review that the improper access may have been occurring for up to 15 years, when the hospital was managed by LSU Health under the name LSU Bogalusa Medical Center.
The employee was questioned about the improper access and it does not appear that any patient health information was shared with any other individuals or was used improperly. This appears to be another case of a healthcare employee accessing medical records out of curiosity.
Even though data theft and misuse is not suspected, out of an abundance of caution, all patients whose privacy was violated have been offered 12 months of credit monitoring services without charge.
The types of information accessed by the former employee includes names, addresses, phone numbers, dates of birth, gender, insurance information, social security numbers, diagnoses, dates of services, places of services, and clinical information such as orders, test results, medications, and clinical abstracts.
Our Lady of the Angels Hospital is reviewing policies and procedures and will be revising its audit processes to ensure any future privacy breaches of this nature are identified more rapidly. Additional training is also being provided to employees regarding the privacy and security of PHI.
