A worker at Trios Health, which is anchored by Trios Southridge Hospital in Washington State, was utilizing its electronic health record (EHR) system not just to perform job duties but to also look up data on sufferers outside of the employee's job function.
The tragedy is the latest in a spate of breaches at healthcare agencies by insiders.
The Trios Health breach was discovered by its health information management department on the day of March 14. Compromised data involved dates of service, diagnoses, demographic information, Social Security numbers, driver’s license numbers, phone numbers and email addresses.
After an inquiry, the agency put in new EHR use restrictions to staff within the worker’s department and terminated the employee. The inquiry continues and as does extra privacy training and new standard auditing procedures to secure PHI. Notification letters to about 600 affected patients started being mailed on the day of May 29.
Trios Health is providing a year of identity theft, credit and fraud monitoring protection services for affected sufferers through Identity Force. Spokespersons for the agency didn’t respond to a request for extra information.
Other breaches at healthcare agencies of protected health information caused by insiders involve the following:
* At Med Center Health in Kentucky, a worker took data on 2 occasions to develop an outside business.
* Beacon Health System in Indiana discovered a worker had been accessing patient emergency department records for 3 years without permission or a reason to view them.
* A volunteer at NYC Health + Hospitals inadvertently caused a breach because she managed protected health information before being completely vetted and trained by the human resources department.
* 2 employees in the patient transport department at the institute of Vanderbilt University Medical Center were inappropriately accessing patient records by gaining more information than required to do their jobs.
Showing posts with label Beacon Health System. Show all posts
Showing posts with label Beacon Health System. Show all posts
Thursday, June 1, 2017
Wednesday, May 31, 2017
Beacon Health System notifies data breach from worker snooping
A worker at Beacon Health System in South Bend, Ind., who for 3 years was accessing patient emergency department (ED) records without permission or a reason to analyze them, has been blamed for a breach of protected health information at the facility.
An audit by Beacon Health found the unwarranted access of patient information, which occurred from the time period of March 2014 to March 2017.
“While the worker might have had authorizations to view records in certain circumstances, the employee viewed patient records without a permissible reason,” the 3-hospital delivery system pointed out in a press release to local media.
“The worker refused taking or misusing any information, and we’ve no evidence that any data was used to commit fraud or otherwise misused,” the statement continued, demonstrating that the employee is no longer employed at Beacon Health System.
Compromised information involves patient names, Social Security numbers, ages, diagnoses, room numbers, acuity of sickness, chief complaints and some financial and insurance coverage information.
Beacon Heath System is reviewing training materials and putting in place new processes to decrease the likelihood of a similar tragedy occurring again. Affected individuals are being offered 1 year of identity monitoring and identity restoration services from Experian, and they are being asserted to monitor account statements and credit reports.
This is the 2nd major breach of protected health information for Beacon Health System, which operates 3 hospitals, home care services and a medical group practice. A hacking tragedy in May 2015 affected 306,789 people.
Beacon Health refused to give more information on the most recent tragedy, but sent the following statement about the incident:
“Beacon Health System’s Information Security and Privacy Team monitor worker access to records 24/7 and investigate potential issues for appropriateness on a daily basis. After an anomaly outside of Beacon’s routine monitoring was traced, upon further review, there was proof that records other than those that were required to complete this individual’s job duties were viewed. A third party forensic review validated that no data was electronically downloaded or transferred. Out of an abundance of caution, Beacon took the most conservative route to report the tragedy and notify those involved.”
An audit by Beacon Health found the unwarranted access of patient information, which occurred from the time period of March 2014 to March 2017.
“While the worker might have had authorizations to view records in certain circumstances, the employee viewed patient records without a permissible reason,” the 3-hospital delivery system pointed out in a press release to local media.
“The worker refused taking or misusing any information, and we’ve no evidence that any data was used to commit fraud or otherwise misused,” the statement continued, demonstrating that the employee is no longer employed at Beacon Health System.
Compromised information involves patient names, Social Security numbers, ages, diagnoses, room numbers, acuity of sickness, chief complaints and some financial and insurance coverage information.
Beacon Heath System is reviewing training materials and putting in place new processes to decrease the likelihood of a similar tragedy occurring again. Affected individuals are being offered 1 year of identity monitoring and identity restoration services from Experian, and they are being asserted to monitor account statements and credit reports.
This is the 2nd major breach of protected health information for Beacon Health System, which operates 3 hospitals, home care services and a medical group practice. A hacking tragedy in May 2015 affected 306,789 people.
Beacon Health refused to give more information on the most recent tragedy, but sent the following statement about the incident:
“Beacon Health System’s Information Security and Privacy Team monitor worker access to records 24/7 and investigate potential issues for appropriateness on a daily basis. After an anomaly outside of Beacon’s routine monitoring was traced, upon further review, there was proof that records other than those that were required to complete this individual’s job duties were viewed. A third party forensic review validated that no data was electronically downloaded or transferred. Out of an abundance of caution, Beacon took the most conservative route to report the tragedy and notify those involved.”
Subscribe to:
Posts (Atom)
