An independent care provider, who provides care to patients of TJ Samson Community Hospital in South Central Kentucky, has recently been discovered to have inappropriately accessed the protected health information (PHI) of 683 patients. The data was all connected to patients of the TJ Samson Community Hospital in Glasgow, KY and the TJ Health Columbia Clinic.
On August 25, 2017, an employee who was completing a routine audit of PHI access logs. An investigation was launched into this inappropriate access, which revealed that two individuals from the healthcare provider’s office had accessed the protected health information of patients. It was determined that they were without any legitimate work reason for accessing the data, and thus were in violation of HIPAA legislation.
Access to patients PHI is necessary for independent health care providers to conduct their work duties. However, in this case, the PHI of patients was accessed even though the patients were not patients of those who accessed the data.
TJ Samson interviewed both individuals about the alleged unauthorized access. They have stated that they are satisfied that no further uses or disclosures of PHI have occurred, and thus patients are not at risk of their data being used for personal gain or with malicious intent.
In response to the incident, TJ Samson has terminated access to any patient for the employees guilty of the breach. In accordance with the HIPAA Breach Notification Rule, information about the breach has been posted to the TJ Samson website. The notice does not indicate any further action was taken against those individuals, although steps have been taken to prevent similar cases of unauthorized access. These precautionary measures include conducting a review of access procedures for independent health care providers. Individuals whose PHI was viewed have been notified of the breach of their confidential information by mail.
The types of information accessed included names, medical information, demographic information, and in some cases, Social Security numbers and insurance information. The access dated back to January 1, 2017. No financial information was accessed as the individuals’ login credentials did not permit them to access such information.