HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

TJ Samson Community Hospital Discovers Inappropriate Accessing of 683 Patients’ PHI

An independent care provider who provides care to patients of TJ Samson Community Hospital in South Central Kentucky, has been discovered to have inappropriately accessed the protected health information (PHI) of 683 patients of TJ Samson Community Hospital in Glasgow, KY and the TJ Health Columbia Clinic.

The inappropriate access was discovered during a routine audit of PHI access logs on August 25, 2017. The subsequent investigation revealed two individuals from the healthcare provider’s office had accessed the protected health information of patients, without any legitimate work reason for doing so.

Access to patients PHI is necessary in order for independent health care providers to conduct their work duties, although in this case, the PHI of patients was accessed even though the patients were not being treated by the individuals.

TJ Samson interviewed both individuals about the alleged unauthorized access and is satisfied that no further uses or disclosures of PHI have occurred.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

In response to the incident, TJ Samson has terminated access for the individuals in question. The breach notice posted to the TJ Samson website does not indicate any further action was taken against those individuals, although steps have been taken to prevent similar cases of unauthorized access, which included conducting a review of access procedures for independent health care providers. Individuals whose PHI was viewed have been notified of the breach of their confidential information by mail.

The types of information accessed included names, medical information, demographic information, and in some cases, Social Security numbers and insurance information. The access dated back to January 1, 2017. No financial information was accessed as the individuals’ login credentials did not permit them to access such information.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.