UMass Memorial Medical Group, Inc.

UMass Memorial Medical Group, Inc., the covered entity (CE), reported that an employee impermissibly accessed the protected health information (PHI) of its patients for approximately four months in 2014. The breach report to OCR, the individuals and the media was delayed at the request of law enforcement officials. Once law enforcement officials indicated that notifications would not compromise their investigation, the CE provided the required notifications. The breach affected approximately 14,000 individuals. The employee was sanctioned and then resigned from the CE. OCR’s investigation revealed that the employee had permissible access to the PHI to perform her job duties, but that she also used that access for a purpose not permitted by the Rules. As a result of OCR’s investigation, the CE implemented new technical safeguards to more closely monitor employee access to PHI and restrict available information in patient records; established new physical safeguards; created a new training program for all staff; engaged a third-party consultant to review its privacy and security programs; and provided free credit monitoring and a call-center for affected individuals. OCR obtained assurances that the CE implemented the corrective actions listed.