PHI Impermissibly Disclosed by Job-Sharing Employee
TapestryHealth, a Connecticut-based provider of technology solutions for post-acute and assisted living facilities, has identified unauthorized access to patient data. A potential HIPAA breach was identified on or around November 3, 2025, when an employee was suspected of job sharing. The employee’s access was immediately terminated pending an investigation.
Job sharing involves an individual gaining employment with a company, then delegating some or all of their contracted job duties to other individuals. While a business associate may use subcontractors to perform certain aspects of its work, the subcontractor is classed as a business associate and must sign a business associate agreement and is subject to the HIPAA Rules. In this case, the job sharing was unauthorized, violated TapestryHealth’s employment and privacy policies, and may have occurred for the duration of the employment period between November 6, 2024, and November 3, 2025. Once confirmed, the employee responsible was terminated.
TapestryHealth determined that there may have been unauthorized access to the following types of protected health information: last name, facility information (name, room number, admission date), medical record number, provider name(s), diagnosis and treatment information, vitals, immunizations, medications, and/or care plan goals and progress notes. Financial information, Social Security numbers, health insurance information, and driver’s license/government IDs were not involved.
In addition to terminating the employee, further controls have been implemented to prevent similar incidents in the future, including limiting the protected health information that can be viewed by employees. TapestryHealth has not found any evidence to indicate that any information has been misused; however, as a precaution, the affected individuals have been offered complimentary credit monitoring and identity theft protection services for 12 months.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
A similar incident was reported earlier this year by Sentara Health, which discovered that three remote workers had been engaging in job sharing and impermissibly shared the protected health information of up to 14,898 patients with unauthorized individuals.
