ProMedica Uncovers Unauthorized Accessing of PHI by 7 Employees
ProMedica has recently discovered that seven of its employees had been improperly accessing the protected health information of patients for almost two years.
The employees in question had been granted access to patient files in order to perform their work duties, but had accessed the medical records of patients who they were not required to treat, nor was there any legitimate business reason for patient data being accessed.
ProMedica was alerted to the privacy breaches on April 7, 2016., and a thorough internal investigation was launched. That investigation revealed that the records of 3,500 patients had been improperly accessed over a period of two years, from May 1, 2014., to April 26, 2016.
Affected patients had received medical services at either ProMedica’s Bixby Hospital in Adrian, MI., or Herrick Hospital in Tecumseh, MI.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The type of data viewed by the employees include patients’ names, addresses, dates of birth, contact telephone numbers, insurance information, medical diagnoses, details of medications that had been prescribed, and other clinical data.
ProMedica’s investigation did not confirm whether any protected health information had been copied by the employees, but the possibility could not be ruled out. Affected patients have now been notified of the privacy breach and have been offered a year of credit monitoring and protection services without charge.
The employees concerned have been disciplined for their actions, and some staff members have had their employment terminated as a result of the HIPAA violations.
Insider data breaches can be the hardest to prevent, although controls can be put in place to reduce the likelihood of snooping by employees. Regular auditing of data access logs can ensure that the improper accessing of medical records can be identified promptly. This breach has prompted ProMedica to conduct regular audits of data access logs and software tools have also been implemented to flag inappropriate accessing of EMR records.
All employees who are granted access to the EMR system are to receive additional training on hospital policies covering the accessing of medical records.
