Sierra View District Hospital

A workforce member of the covered entity (CE), Sierra View Medical Center, impermissibly accessed an internal hospital roster covering different departments over a period of several days between July and August 2013, which potentially affected the electronic protected health information (ePHI) of approximately one thousand nine (1,009) individuals. The ePHI included patients' names, room numbers, treating physicians' information, diagnoses, and medical record data, including treatment notes. The CE provided breach notification to HHS, affected individuals, and the media. The CE investigated and determined that the employee had not used the information, despite impermissibly accessing it. The CE sanctioned the employee, implemented compliance actions to meet workforce security standards, including log-in monitoring. The CE also revised policies and procedures and conducted training on the security awareness standard. OCR provided substantive technical assistance and identified corrective actions that the CE must complete to comply with the Security Rule, which includes the following: conduct and monitor a comprehensive, enterprise-wide risk analysis, update and monitor its risk management plan, and monitor its information access management to ensure adequate safeguards of ePHI.