Hospital Security Guards Snooping on Medical Records Causes $240,000 HIPAA Settlement
The breach affected more than 419 people, so Yakima Valley Memorial Hospital in Washington settles major fine after OCR investigation.
What Happened? The Situation
The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) investigated claims that several security guards from the hospital impermissibly accessed the medical records of 419 individuals.
The investigation began in May 2018 after the OCR received a
breach notification report about Yakima Valley Memorial Hospital.
- An alleged 23 security guards employed in the hospital's emergency department inappropriately used their login credentials to access medical records in the organization's electronic medical record (EMR) system.
- These security guards had unauthorized access to protected health information (PHI) including names, birth dates, medical records numbers, mailing addresses, treatment notes, and even insurance information.
- Impermissibly accessing protected health information (PHI) is a severe HIPAA violation, especially when access is without a job-related purpose.
Prying Eyes Have No Secrets (Nor Security)
The OCR determined Yakima Valley Memorial Hospital (a
nonprofit community hospital in Yakima, Washington) violated the Health
Insurance Portability and Accountability Act (HIPAA) which protects the privacy
and security of protected health information.
"Data breaches caused by current and former workforce members impermissibly accessing patient records are a recurring issue across the healthcare industry. Health care organizations must ensure that workforce members can only access the patient information needed to do their jobs. HIPAA covered entities must have robust policies and procedures in place to ensure patient health information is protected from identify theft and fraud."
- OCR Director Melanie Fontes Rainer.
In response to the investigation, Yakima Valley Memorial
Hospital agreed to pay $240,000 and update its policies and procedures to
safeguard protected health information. They also agreed to incorporate
enhanced training for their workforce on HIPAA policies and procedures, as well
as engaging with vendors and third-party service providers to ensure full
compliance moving forward.
Summary of the Resolution Agreement and Corrective Action Plan
In addition to the settlement fine, Yakima Valley Memorial Hospital will be monitored for two
years by OCR to ensure compliance with the HIPAA Security Rule.
The details outlined in the resolution agreement produced by
the OCR reveals that Yakima Valley Memorial Hospital has agreed to take the
following corrective actions to bring their organization into compliance with
the HIPAA Rules:
Security Risk Analysis (SRA)
"Conduct an accurate and thorough risk analysis to determine
risks and vulnerabilities to electronic protected health information (ePHI)."
Risk Management Program
"Develop and implement a risk management plan to address and
mitigate identified security risks and vulnerabilities identified in the risk
HIPAA Policies and Procedures
"Develop, maintain, and revise, as necessary, its written
HIPAA policies and procedures."
HIPAA Privacy and Security Workforce Training
"Enhance its existing HIPAA and Security Training Program to
provide workforce training on the updated HIPAA policies and procedures."
Business Associate Agreements (BAAs)
"Review all relationships with vendors and third-party
service providers to identify business associates and obtain business associate
agreements with business associates if not already in place."
You can read the resolution agreement and corrective action plan in full here: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/yakima-ra-cap/index.html
As the HHS's enforcement agency of HIPAA Privacy and
Security Rules about PHI, remember that the OCR is legally obligated to
investigate all complaints filed on OCR's website by individuals
who feel that their health privacy or civil rights have been violated.
Need help with HIPAA Compliance?
Get in touch with an HCP Compliance Advisor today. Discover how to achieve true protection through an effective HIPAA Compliance Program.