PeaceHealth

A former PeaceHealth mployee continued to access the electronic protected health information (ePHI) of the covered entity's (CE) patients through websites used for third-party prior authorization and insurance verification. Approximately 1,407 individuals were affected by the breach. The types of ePHI involved in the breach included names, addresses, dates of birth, social security numbers, diagnoses/conditions, medications, medical record numbers, and payor identification numbers. In response to the breach, the CE implemented database tracking for employees who have third party portal access, so that the database will alert management when an employee leaves employment and the portal companies will be immediately contacted to terminate access. The CE provided breach notification to HHS, affected individuals, and the media. The CE also provided one year of free credit monitoring for those individuals whose social security numbers were included in the breach. OCR provided the CE with technical assistance regarding the risk analysis and risk management provisions of the Security Rule.