Harris Health in Texas has recently started notifying more than 5,000 patients that their electronic health records may have been impermissibly accessed by a former employee. Concerningly, the unauthorized access had been ongoing for a decade before it was identified.
Harris Health operates Ben Taub Hospital and Lyndon B. Johnson Hospital, and a network of 37 clinics, health centers, and specialty locations in and around Houston, Texas. While notification letters are now being mailed to the affected individuals, the unauthorized access was detected on February 10, 2021. An investigation was launched to determine the extent of the employee’s HIPAA violation, with assistance provided by a nationally recognized digital forensics firm. The investigation confirmed unauthorized access to patient records from January 4, 2011, to March 8, 2021.
After confirming that patients’ medical records had been accessed without any legitimate work purpose, the employee was terminated, and the Federal Bureau of Investigation (FBI) was notified. Harris Health has been assisting with the investigation, which confirmed that the employee had disclosed some patient information to unauthorized individuals. The substitute breach notice on the Harris Health website doesn’t provide any indication as to why patients’ records were being accessed or the purpose of the disclosure of patient data.
Harris Health was unable to determine the specific patients whose protected health information was disclosed to other individuals, so notification letters are being sent to all individuals whose data may have been impermissibly disclosed. Notification letters were delayed at the request of law enforcement so as not to interfere with the investigation. While law enforcement requests to delay notifications are not unusual, a 4-year delay is unusually long. Typically, notifications are only delayed by a few weeks or months.
Data potentially accessed and disclosed includes demographic information such as names, dates of birth, addresses, email addresses, telephone numbers, and medical record numbers; clinical information such as diagnoses, medical history, medications, immunizations, dates of service, and provider names; health insurance information, and, for a limited number of individuals, Social Security numbers. Individuals whose Social Security numbers were involved have been offered complimentary credit monitoring and identity theft protection services.
All individuals potentially affected have been advised to monitor their explanation of benefits statements and should report any suspicious activity to their health insurer. Harris Health said it is providing further training to the workforce on the importance of protecting patient privacy, and additional tools have been implemented that allow proactive monitoring of employee access to patient records and provide enhanced auditing capabilities to help Harris Health identify unauthorized access more quickly in the future.
Under HIPAA, all employees should be provided with unique logins to allow their interactions with patient information to be tracked. Logs should be maintained to support investigations of unauthorized access to patient records, and those logs should be regularly reviewed. Regular reviews of access logs will help to limit the harm caused if employees impermissibly access patient records. HIPAA-covered entities should also ensure that they provide HIPAA training to their employees during onboarding, as well as annual refresher training sessions to remind employees of their responsibilities under HIPAA and the importance of protecting patient privacy.
The post Harris Health Notifies Patients About 10-Year Insider Data Breach appeared first on The HIPAA Journal.