It is not the first time we have written about complaints, OCR settlements, and even jail time following snooping by hospital employees into patient records. For example, as COVID raged, an investigation showed that for approximately 10 months ending in February, 2021, an employee at a California state hospital improperly accessed approximately 2,000 individuals’ COVID-19 related data including test results. Preventing these kinds of breaches can be difficult especially when system assess is needed to facilitate the efficient and often urgent delivery of health care.

Yesterday, the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR), announced a settlement with a not-for-profit community hospital under HIPAA. As many do, the settlement resulted from an investigation of a data breach report submitted by the hospital. According to the report, 23 security guards working in the hospital’s emergency department used their login credentials to access patient medical records maintained in hospital’s electronic medical record (EMR) system without a job-related purpose. The information accessed included names, dates of birth, medical record numbers, addresses, certain notes related to treatment, and insurance information. The breach affected 419 individuals.  

“Data breaches caused by current and former workforce members impermissibly accessing patient records are a recurring issue across the healthcare industry. Health care organizations must ensure that workforce members can only access the patient information needed to do their jobs,” said OCR Director Melanie Fontes Rainer. “HIPAA covered entities must have robust policies and procedures in place to ensure patient health information is protected from identify theft and fraud.”

In addition to agreeing to pay $240,000, the hospital also agreed to be monitored under a two-year corrective action plan (CAP). The CAP included the following steps:

• Conduct an accurate and thorough risk analysis to determine risks and vulnerabilities to electronic protected health information.
• Develop and implement a risk management plan to address and mitigate identified security risks and vulnerabilities identified in the risk analysis;
• Develop, maintain, and revise, as necessary, its written HIPAA policies and procedures;
• Enhance its existing HIPAA and Security Training Program to provide workforce training on the updated HIPAA policies and procedures;
• Review all relationships with vendors and third-party service providers to identify business associates and obtain business associate agreements with business associates if not already in place.

Digging into the details of the settlement and CAP, it is clear OCR is focused on access management – ensuring appropriate access between systems, ensuring access only to those that need it, providing training about access, etc. Another consideration, prudent for any kind of surveillance, is monitoring the monitors. That is, for example, regularly reviewing access logs to assess appropriateness of the activity.

Organizations, whether covered by HIPAA or not, engaged in monitoring and surveillance activities should be thinking about how to control the nature and extent of that monitoring and surveillance to avoid unintended consequences. This includes assessing the safeguards implemented by third party vendors supporting the systems, devices, and activities. Data security should not be focused only on systems designed to prevent external hackers, but also what can be done internally to prevent unauthorized access, uses, and disclosures of confidential and sensitive personal information by insiders, employees.