Palomar Health (Palomar Medical Center (Escondido)

On February 10, 2016, the covered entity (CE), Palomar Medical Center, discovered that a PMC- Escondido Emergency Room (ER) nurse accessed the medical records of patients without a work-related reason to do so. The types of protected health information (PHI) involved in the breach included the demographic and clinical information of approximately 1,309 individuals. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE implemented new technical safeguards, provided individuals with free credit monitoring, and sanctioned the workforce member. As a result of OCR’s investigation, the CE restricted the ER nurse from having access to its facilities, patients, and the electronic medical record. The CE reported the matter to the Board of Registered Nursing (BRN) and the California Department of Public Health (CDPH). The CE’s Information Security Office circulated an information security awareness sheet related to unauthorized access via email to all employees and began implementing a new functionality of the Fair Warning tool: a report that runs daily and identifies disproportionate instances of access to patient medical records by staff members. The CE strengthened and revised its policies and procedures, performed an assessment, and provided refresher training to all clinical staff regarding proper procedures for administering medication and interacting with automatic medication dispensing machines that contain PHI. In addition, new nurses receive training from the Pharmacy Department as part of the new employee orientation. OCR obtained assurances that the CE implemented the corrective actions listed above. In this case, the nurse involved in the breach resigned from employment.