What happened?
Yakima Valley Memorial is a non-profit community hospital in Washington State (USA). According to an announcement by the Office for Civil Rights (OCR) of the US Department of Health and Human Services, 23 security guards working in the emergency department used their own assigned accounts to view the electronic medical records of 419 patients with no work-related purpose.
The hospital reported the incident on 28/2/2018 and OCR opened an investigation in May 2018. On 15/5/2023 the two sides signed a resolution agreement, announced by OCR on 15/6/2023: the hospital paid USD 240,000 and carried out a two-year corrective action plan. The agreement is not an admission of violation.
What does the corrective action plan include?
- A hospital-wide risk assessment and a risk-management plan.
- Updated policies and procedures on protecting health information, and staff training.
- A review of agreements with partners that have access to the data.
- Periodic compliance reports to the regulator.
Lessons for enterprises
- Having a valid account does not mean being allowed to see everything. OCR stressed that organizations need policies limiting access to what each person's duties require.
- Incidents caused by people inside the organization are a recurring problem, not only in healthcare but in every sector that handles customer, HR or contract records.
- Access logs must be reviewed, not merely stored. This case shows the value of periodically reviewing who opened which record.
A data-centric approach
For sensitive data such as medical records, contracts or customer information, enterprises can set role-based permissions on the file itself, log who opens, edits, prints or copies, and use dynamic watermarks that show the viewer's identity to deter unnecessary curiosity. These measures support the "access only when needed" principle and must come with training and internal policy. See also the product.
Three questions for a self-check
- Who currently has the right to open records containing personal data, and why do they need that right?
- How often do you review access logs, and who is responsible?
- Do the people viewing documents know that every open is recorded?
Reference sources
- Morgan Lewis: OCR announces settlement agreement in PHI breach
- BankInfoSecurity: Hospital fined $240K for records snooping breach by guards
