HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

ProMedica Uncovers Unauthorized Accessing of PHI by 7 Employees

ProMedica has recently discovered that seven of its employees had been improperly accessing the protected health information of patients for almost two years.

The employees in question had been granted access to patient files in order to perform their work duties, but had accessed the medical records of patients who they were not required to treat, nor was there any legitimate business reason for patient data being accessed.

ProMedica was alerted to the privacy breaches on April 7, 2016., and a thorough internal investigation was launched. That investigation revealed that the records of 3,500 patients had been improperly accessed over a period of two years, from May 1, 2014., to April 26, 2016.

Affected patients had received medical services at either ProMedica’s Bixby Hospital in Adrian, MI., or Herrick Hospital in Tecumseh, MI.

Please see the HIPAA Journal Privacy Policy

The type of data viewed by the employees include patients’ names, addresses, dates of birth, contact telephone numbers, insurance information, medical diagnoses, details of medications that had been prescribed, and other clinical data.

ProMedica’s investigation did not confirm whether any protected health information had been copied by the employees, but the possibility could not be ruled out. Affected patients have now been notified of the privacy breach and have been offered a year of credit monitoring and protection services without charge.

The employees concerned have been disciplined for their actions, and some staff members have had their employment terminated as a result of the HIPAA violations.

Insider data breaches can be the hardest to prevent, although controls can be put in place to reduce the likelihood of snooping by employees. Regular auditing of data access logs can ensure that the improper accessing of medical records can be identified promptly. This breach has prompted ProMedica to conduct regular audits of data access logs and software tools have also been implemented to flag inappropriate accessing of EMR records.

All employees who are granted access to the EMR system are to receive additional training on hospital policies covering the accessing of medical records.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.