Tri-City Medical Center

On August 7, 2014, an employee who was being terminated for cause took emergency department (ED) logs for 500 patients of the covered entity (CE), Tri-City Medical Center, and gave them to the California Department of Public Health (DPH) and the North County Newspaper. Upon learning of the theft, the CE contacted DPH which advised that it had the logs and would give them to the local police department once the CE filed a report for theft. The CE contacted the local police department and created a report of the 500 patients’ electronic protected health information (ePHI). The CE provided breach notification to HHS, affected individuals, and the media and created an 800-number to provide information for affected patients. The CE improved safeguards by reformatting the ED logs required for Emergency Medical Treatment and Labor Act (EMTALA) to be handled only electronically, placing all ED paper logs in a locked/secured cabinet, converted locks, and relocated all its printers and faxes to secure areas. The CE also retrieved the ED logs from the police department, retrained its entire workforce, and developed a facility policy for tracking the check-in and check-out of facility logs. OCR obtained written assurances that the CE implemented the corrective actions listed.