HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

PeaceHealth Employee Accessed Medical Records Without Authorization for Almost 6 Years

PeaceHealth, a not-for-profit Catholic health system based in Vancouver, WA, has discovered one of its former employees had accessed the medical records of almost 2,000 of its patients without any legitimate work reason for doing so.

The unauthorized access was discovered by PeaceHealth on August 9, 2017, triggering an investigation. PeaceHealth determined the improper access started in November 2011 and continued until July 2017.

The investigation confirmed Social Security numbers and financial information were not accessed by the employee, although patient names, medical record numbers, admission and discharge dates, medical diagnoses, and progress notes were all viewed.

Due to the nature of information that was accessed, and the results of the internal investigation, PeaceHealth does not believe any patients impacted by the breach are at risk of identity theft. However, all impacted individuals have been advised to remain vigilant and review their credit reports and account statements for any sign of fraudulent activity.

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

Patients impacted by the breach had visited either the PeaceHealth St. Joseph Medical Center or its Southwest Medical Center between November 2011 and July 2017. All individuals affected by the incident have now been notified of the breach by mail.

PeaceHealth issued a statement saying, “Patient privacy is among our highest priorities, and we take this [incident] very seriously.” The employee no longer works for PeaceHealth.

PeaceHealth already invests in technology to prevent data breaches, follows industry best practices for monitoring and safeguarding PHI, and provides training to staff on privacy and security. The incident has prompted PeaceHealth to reinforce education of its staff with respect to appropriate accessing of PHI.

The incident has now been reported to the Department of Health and Human Services’ Office for Civil Rights. The breach report indicates the PHI of 1,969 patients was improperly accessed.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.