Trios Health Discovers Employee Accessed EHR Without Authorization for 41 Months
The medical records of 570 Trios Health patients have been accessed by an employee, without authorization, over a period of 41 months.
In March, Trios Health noticed some irregularities in its EHR logs which suggested patient records were being accessed without any legitimate work purpose for doing so. An investigation was launched to investigate and the employee was placed on leave. The investigation revealed the employee had accessed hospital patient records without authorization between October 2013 and March 2017.
The types of information that was viewed included names, contact information, driver’s license numbers, Social Security numbers, dates of service, demographic information and limited medical information such as diagnoses.
Interviews were conducted, although a spokesperson for Trios Health said, “We don’t know the motivation,” although it would appear that no harm was intended by the employee. Trios Health says the risk of information being used inappropriately is low, although credit monitoring and identity theft protection services are being offered to affected patients for 12 months without charge as a precautionary measure.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Trios Health interim CEO said, “We cannot succeed as an organization without holding ourselves and others responsible for mistakes and taking decisive action to address them.”
The employee has now been terminated for violating hospital policies and HIPAA Rules and Trios Health is implementing software that will alert staff to improper ePHI access. EHR restrictions have also been put in place to limit ePHI access, with staff only able to access the records of patients in their own department.
If a member of staff attempts to access the medical records of a patient that they are unauthorized to view, access will be prevented, a popup warning will appear on screen and an alert of attempted ePHI access will be sent to a supervisor. Staff have also received additional privacy training and a new PHI auditing process will be implemented.
The incident has now been reported to the state Attorney General and the Department of Health and Human Services’ Office for Civil Rights. Patients impacted by the breach are being notified by mail.
