Weill Cornell Medical College

From October 17, 2013 to March 21, 2014, a former faculty member impermissibly accessed 3,936 patients’ protected health information (PHI) from the covered entity's (CE) electronic health record (EHR) system by using login credentials of an unknowing employee. The types of PHI accessed included clinical and demographic information. The CE, Weill Cornell Medical College, provided breach notification to HHS, affected individuals and the media. Following the breach, the CE strengthened its password policy, implemented multifactor authentication for access to systems containing sensitive information, and reconfigured alerts to further detect suspicious activity. The CE revised its policies to ensure all devices that contain its data are encrypted, clearly identify responsibilities for ensuring password compliance, and require password expiration. The CE created a new policy outlining the requirements for security systems and a sanctions policy to allow IT to restrict network access for systems that pose a serious threat or impact to the CE’s network. OCR obtained assurances that the CE implemented the corrective actions listed. Additionally, the CE is expected to conduct a risk analysis, implement a corresponding remediation plan, and ensure the implementation of policies and procedures relating to information system activity review, security incident response and reporting, access and audit controls, and creating/maintaining retrievable exact copies of ePHI.