Jones Family Practice, P.A.

Jones Family Practice, the covered entity (CE), reported that an employee obtained the medical records of 742 patients on the day of her employment termination by using the CE’s electronic medical records (EMR) system. The protected health information (PHI) included patients’ names, lab results, progress notes, and patient summaries. As a result of the breach and OCR’s involvement, the CE developed a new procedure for terminating an employee’s access to its EMR system. The CE also created and executed a HIPAA compliant business associate agreement with its EMR provider, Quest Diagnostics Clinical Laboratories, Inc. The CE also provided breach notification to HHS, affected individuals, and the media. OCR obtained assurances that the CE implemented the corrective actions noted above.