In a significant breach of privacy, several security guards from Yakima Valley Memorial Hospital in Washington have been found to have impermissibly accessed the medical records of 419 individuals. This violation of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) has resulted in a $240,000 settlement and a commitment from the hospital to update its policies and procedures to prevent such breaches in the future.
Why it matters
HIPAA is a federal law that protects the privacy and security of protected health information. The violation of this law by hospital security guards underscores the importance of stringent access controls and monitoring systems to prevent unauthorized access to sensitive patient data. Healthcare organizations could suffer financial and reputational costs for failing to adequately protect patient information.
The big picture
The breach was discovered when the hospital reported that 23 security guards working in the hospital's emergency department used their login credentials to access patient medical records without a job-related purpose. The information accessed included names, dates of birth, medical record numbers, addresses, notes related to treatment, and insurance information. This incident highlights the importance of robust access controls and logs in preventing unauthorized access to sensitive patient data.
What they're saying
"Data breaches caused by current and former workforce members impermissibly accessing patient records are a recurring issue across the healthcare industry. Health care organizations must ensure that workforce members can only access the patient information needed to do their jobs," said OCR Director Melanie Fontes Rainer. "HIPAA covered entities must have robust policies and procedures in place to ensure patient health information is protected from identify theft and fraud."
What's next
As part of the settlement agreement, Yakima Valley Memorial Hospital will be monitored for two years by OCR to ensure compliance with the HIPAA Security Rule. The hospital has agreed to conduct a thorough risk analysis, develop a risk management plan, revise its written HIPAA policies and procedures, enhance its existing HIPAA and Security Training Program, and review all relationships with vendors and third-party service providers to identify business associates.
Between the lines
This incident underscores the importance of HIPAA regulations and the need for healthcare organizations to have stringent access controls and monitoring systems in place. It serves as a reminder that not all threats to patient data security come from external sources; sometimes, the threat can be internal, as was the case with the security guards at Yakima Valley Memorial Hospital.
The bottom line
The unauthorized access of patient records by hospital security guards at Yakima Valley Memorial Hospital is an ongoing threat to patient data security. HIPAA compliance, robust access controls, and effective monitoring systems are required to protect patient data. As healthcare organizations continue to digitize patient records, the need for stringent data security measures is a must to remain compliant and avoid penalties.
Go deeper:
Dean Levitt
