HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Trios Health Discovers Employee Accessed EHR Without Authorization for 41 Months

The medical records of 570 Trios Health patients have been accessed by an employee, without authorization, over a period of 41 months.

In March, Trios Health noticed some irregularities in its EHR logs which suggested patient records were being accessed without any legitimate work purpose for doing so. An investigation was launched to investigate and the employee was placed on leave. The investigation revealed the employee had accessed hospital patient records without authorization between October 2013 and March 2017.

The types of information that was viewed included names, contact information, driver’s license numbers, Social Security numbers, dates of service, demographic information and limited medical information such as diagnoses.

Interviews were conducted, although a spokesperson for Trios Health said, “We don’t know the motivation,” although it would appear that no harm was intended by the employee. Trios Health says the risk of information being used inappropriately is low, although credit monitoring and identity theft protection services are being offered to affected patients for 12 months without charge as a precautionary measure.

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

Trios Health interim CEO said, “We cannot succeed as an organization without holding ourselves and others responsible for mistakes and taking decisive action to address them.”

The employee has now been terminated for violating hospital policies and HIPAA Rules and Trios Health is implementing software that will alert staff to improper ePHI access. EHR restrictions have also been put in place to limit ePHI access, with staff only able to access the records of patients in their own department.

If a member of staff attempts to access the medical records of a patient that they are unauthorized to view, access will be prevented, a popup warning will appear on screen and an alert of attempted ePHI access will be sent to a supervisor. Staff have also received additional privacy training and a new PHI auditing process will be implemented.

The incident has now been reported to the state Attorney General and the Department of Health and Human Services’ Office for Civil Rights. Patients impacted by the breach are being notified by mail.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.