PeaceHealth Employee Accessed Medical Records Without Authorization for Almost 6 Years
PeaceHealth, a not-for-profit Catholic health system based in Vancouver, WA, has discovered one of its former employees had accessed the medical records of almost 2,000 of its patients without any legitimate work reason for doing so.
The unauthorized access was discovered by PeaceHealth on August 9, 2017, triggering an investigation. PeaceHealth determined the improper access started in November 2011 and continued until July 2017.
The investigation confirmed Social Security numbers and financial information were not accessed by the employee, although patient names, medical record numbers, admission and discharge dates, medical diagnoses, and progress notes were all viewed.
Due to the nature of information that was accessed, and the results of the internal investigation, PeaceHealth does not believe any patients impacted by the breach are at risk of identity theft. However, all impacted individuals have been advised to remain vigilant and review their credit reports and account statements for any sign of fraudulent activity.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Patients impacted by the breach had visited either the PeaceHealth St. Joseph Medical Center or its Southwest Medical Center between November 2011 and July 2017. All individuals affected by the incident have now been notified of the breach by mail.
PeaceHealth issued a statement saying, “Patient privacy is among our highest priorities, and we take this [incident] very seriously.” The employee no longer works for PeaceHealth.
PeaceHealth already invests in technology to prevent data breaches, follows industry best practices for monitoring and safeguarding PHI, and provides training to staff on privacy and security. The incident has prompted PeaceHealth to reinforce education of its staff with respect to appropriate accessing of PHI.
The incident has now been reported to the Department of Health and Human Services’ Office for Civil Rights. The breach report indicates the PHI of 1,969 patients was improperly accessed.
