Phoebe Putney Memorial Hospital

On April 9, 2012, Phoebe Putney Memorial Hospital, Inc., the covered entity (CE), learned from law enforcement that an employee of Phoebe Home Care (PHC), a department of the CE, improperly accessed patients' protected health information (PHI) with the intent to process fraudulent tax returns. An internal investigation and audit concluded that the employee accessed the medical records in a combination of paper and electronic form. The PHI affected 2,354 individuals and contained patients’ names, dates of birth and social security numbers. In response to the breach, the CE sanctioned the responsible employee. The CE provided breach notification to HHS, affected individuals, and the media and also posted substitute notice on its website. The CE improved safeguards by locking cabinets containing patient files, creating a security access hierarchy to assure role-based access to PHI, and encrypting laptop computers. Additionally, the CE removed social security numbers from its referral form and removed employee social security numbers from its software system. The CE implemented monthly audits on its electronic medical records system and established an annual HIPAA in-service training program for management and staff. OCR obtained assurances that the CE implemented the corrective actions listed above.