A former nurse employed by the Roswell Park Comprehensive Cancer Center in Buffalo, NY, has been sentenced to 37 months in prison for tampering with and stealing controlled medications intended for cancer patients.

Kelsey A. Mulvey, 30, of Grand Island, NY, worked as a registered nurse at Roswell Park between February 2018 and June 2018. On June 27, 2018, Mulvey was observed accessing a medication dispensing machine in a room to which she was not assigned and left carrying a backpack. She was placed on administrative leave pending an investigation and later resigned. The investigation concluded Mulvey had stolen hydromorphone, methadone, oxycodone, and lorazepam from the automated medication dispensing systems.

In June and July 2018, six patients at Roswell Park became ill with waterborne infections. The investigation concluded that Mulvey had replaced the hydromorphone in the vials with water to hide the theft. Roswell Park has a zero-tolerance policy and immediately notified the New York State Department of Health, the NYS Department of Education, the Bureau of Narcotics and Tobacco Enforcement, U.S. Drug Enforcement Agency, and NYPORT about the drug theft and tampering. The U.S. Attorney’s Office charged Mulvey with tampering with a consumer product, acquiring controlled substances by fraud, and criminal violations of the Heath Insurance Portability and Accountability Act (HIPAA). Prosecutors said the drug thefts resulted in a failure to properly administer medications for 81 Roswell Park patients.

Mulvey faced a maximum jail term of 10 years for the offenses. She entered into a plea agreement and pleaded guilty to one count of tampering with a consumer product. The criminal HIPAA violations and other charges were dropped as part of the agreement. Mulvey also agreed to surrender her nursing license. Roswell Park said that after the theft was discovered, new surveillance systems were implemented, policies and procedures were reviewed and updated, and staff training and education were increased concerning drug diversion.

The post Nurse Sentenced to 37 Months in Jail for Tampering with and Stealing Medications appeared first on HIPAA Journal.

A former nurse employed by the Roswell Park Comprehensive Cancer Center in Buffalo, NY, has been sentenced to 37 months in prison for tampering with and stealing controlled medications intended for cancer patients.

Kelsey A. Mulvey, 30, of Grand Island, NY, worked as a registered nurse at Roswell Park between February 2018 and June 2018. On June 27, 2018, Mulvey was observed accessing a medication dispensing machine in a room to which she was not assigned and left carrying a backpack. She was placed on administrative leave pending an investigation and later resigned. The investigation concluded Mulvey had stolen hydromorphone, methadone, oxycodone, and lorazepam from the automated medication dispensing systems.

In June and July 2018, six patients at Roswell Park became ill with waterborne infections. The investigation concluded that Mulvey had replaced the hydromorphone in the vials with water to hide the theft. Roswell Park has a zero-tolerance policy and immediately notified the New York State Department of Health, the NYS Department of Education, the Bureau of Narcotics and Tobacco Enforcement, U.S. Drug Enforcement Agency, and NYPORT about the drug theft and tampering. The U.S. Attorney’s Office charged Mulvey with tampering with a consumer product, acquiring controlled substances by fraud, and criminal violations of the Heath Insurance Portability and Accountability Act (HIPAA). Prosecutors said the drug thefts resulted in a failure to properly administer medications for 81 Roswell Park patients.

Mulvey faced a maximum jail term of 10 years for the offenses. She entered into a plea agreement and pleaded guilty to one count of tampering with a consumer product. The criminal HIPAA violations and other charges were dropped as part of the agreement. Mulvey also agreed to surrender her nursing license. Roswell Park said that after the theft was discovered, new surveillance systems were implemented, policies and procedures were reviewed and updated, and staff training and education were increased concerning drug diversion.

The post Nurse Sentenced to 37 Months in Jail for Tampering with and Stealing Medications appeared first on HIPAA Journal.

Conway Regional Medical Center, a non-profit healthcare system in north central Arkansas, has proposed a $295,000 settlement to resolve a class action lawsuit that was filed on behalf of individuals affected by a 2019 data breach.

The data breach in question occurred in June 2019. Email accounts containing the protected health information of patients were accessed by unauthorized individuals after employees responded to phishing emails. The review of the email accounts revealed they contained patient names, addresses, Social Security numbers, medical information, and health insurance information. Approximately 37,000 patients were affected and had their information exposed.

Following the breach, a lawsuit – Danielle Marshall v. Conway Regional Medical Center Inc – was filed in Faulkner County Circuit Court alleging Conway Regional was negligent for failing to implement appropriate safeguards to protect patient information, and that as a direct result of that negligence, the protected health information of the plaintiff and class members allowed that information to be accessed by criminals. Conway Regional maintains that it had implemented meritorious defenses against phishing and other cyber threats and was prepared to vigorously defend the lawsuit; however, the decision was taken to settle the lawsuit to end the litigation and prevent further legal costs. Conway Regional says the settlement has been proposed to resolve the disputed claims and is not an admission of any lawbreaking or wrongdoing.

Under the terms of the proposed settlement, class members will be eligible to receive two years of identity theft protection services through IDX. Instructions for signing up for those services are detailed in the settlement. In contrast to many settlements that allow claims to be submitted for documented losses, there are some caveats. A claim of up to $850 may be submitted for reimbursement of documented losses, but only by class members who have enrolled in the IDX services that have activated them per the instructions, and if a claim is first submitted through the IDX service and that claim is denied. Before submitting a claim, class members must also exhausted the IDX claim process. If IDX rejects the claim because it was not submitted within the allowed time frame or due to insufficient documentation, class members will not be eligible to claim for reimbursement under the settlement. Class members may also claim up to $40 for lost time fairly traceable to the data breach, independent of any claim for documented losses, and regardless of whether they have signed up for the IDX services.

To sign up for the IDX services, class members must complete the Election form before February 20, 2023. Claims for reimbursement of economic losses and lost time must also be submitted by February 20, 2023. The deadline for exclusion from or objection to the settlement is December 21, 2022. A fairness hearing has been scheduled for February 7, 2023.

The post $295,000 Settlement Proposed by Conway Regional Medical Center to Resolve Data Breach Lawsuit appeared first on HIPAA Journal.

San Juan Regional Medical Center (SJRMC) in Farmington, New Mexico, has proposed a settlement to resolve a class action lawsuit filed in response to a September 2020 data breach that affected 68,792 patients.

On September 8, 2020, hackers gained access to the SJRMC network and exfiltrated files that contained patient information such as names, dates of birth, Social Security numbers, driver’s license numbers, passport information, financial account numbers, health insurance information, diagnoses, treatment information, medical record numbers, and patient account numbers. San Juan Regional Medical Center stated at the time that this was a malware, rather than a ransomware attack. Complimentary credit monitoring services were offered to patients for a period of 12 months.

A lawsuit – Henderson, et al. v. San Juan Regional Medical Center – was filed on behalf of Jeremy Henderson, a patient of SJRMC and other patients similarly affected by the breach. The lawsuit alleged SJRMC was negligent for failing to adequately secure patient data. While legal action was not taken over a HIPAA violation, the lawsuit alleged the lack of appropriate safeguards constituted a HIPAA violation.

SJRMC chose to settle the lawsuit to prevent further legal costs and avoid the uncertainty of trial but has admitted no wrongdoing and accepts no liability for the cyberattack and data breach. The settlement covers all individuals whose personally identifiable information or protected health information was compromised as a result of the cyberattack, as well as a subclass of individuals who were notified by SJRMC that their Social Security, financial account, driver’s license, or passport numbers had potentially been compromised.

Under the terms of the settlement, all affected individuals are entitled to receive two years of complimentary credit monitoring and identity theft protection services, with the subclass also entitled to submit a claim for up to $2,500 as compensation for losses suffered in response to the breach. Those losses include reimbursement of out-of-pocket expenses, compensation for fees for credit reports, credit monitoring, or other identity-theft insurance products purchased after October 13, 2022, compensation at $17.50 per hour for lost time related to the cyberattack if at least one hour was lost dealing with the effects of the data breach, and compensation for documented monetary losses.

The final data for objection to or exclusion from the settlement is January 9, 2023. All claims must be submitted by February 8, 2023. A fairness hearing for the settlement has been scheduled for February 22, 2023.

The post San Juan Regional Medical Center Settles Data Breach Lawsuit appeared first on HIPAA Journal.