Pennsylvania Hospital Notifies 1,801 Patients of HIPAA Breach | Healthcare Informatics Magazine | Health IT | Information Technology Skip to content Skip to navigation

Pennsylvania Hospital Notifies 1,801 Patients of HIPAA Breach

June 9, 2014
by Rajiv Leventhal
| Reprints

Penn State Milton S. Hershey Medical Center is notifying 1,801 patients that their protected health information (PHI) had the potential to be accessed by individuals not involved in their care due to the actions of an employee who had accessed the data without having proper IT security protections in place.

Results of an internal investigation give no indication that any unauthorized person actually viewed or accessed this PHI as a result of the employee’s activity. However, because the employee worked with this information on devices and systems outside the safeguards and controls of the secure Penn State Hershey information network, medical center officials said they cannot completely rule out the possibility and are notifying patients out of an abundance of caution.

The information involved is specifically related to a type of test ordered by Penn State Hershey women’s health or family medicine clinicians, as well as other medical practitioners in the community who used Penn State Hershey laboratories for testing, between August 1, 2013 and March 26, 2014.

On April 11, 2014, the 551-bed medical center learned that one of its clinical laboratory technicians had been working with PHI—entering this information into a test log—from his home. Specifically, the test log contained information related to tests ordered in conjunction with patient visits that occurred at Penn State Hershey’s women’s health and family practice clinician offices. It also contained information from other physicians’ offices in the community that used Penn State Hershey’s lab to perform the tests over the same time period. The test log information included patient names, medical record numbers, name of lab test, visit dates, and test results.

The employee was authorized to access and use this information because of his job at Penn State Hershey. However he worked on the test log at home using systems and devices outside the secured Penn State Hershey system—his personal computer, a removable storage device (a flash drive) to transport the log home to continue his work after hours and his personal email account to send the updated test log to two Penn State Hershey physicians. No Social Security numbers and no financial information were included in the test log, officials said.

Get the latest information on Health IT and attend other valuable sessions at this two-day Summit providing healthcare leaders with educational content, insightful debate and dialogue on the future of healthcare and technology.

Learn More

Topics

News

Geisinger National Precision Health Hires Illumina Exec to Lead Business Development

Integrated health system Geisinger has hired a high-profile genetic counselor to head up business development for Geisinger National Precision Health, which was created to extend the Geisinger model on the national scene.

$30M VC Fund Launched to Spur Innovation in Cardiovascular Care

The American Heart Association, together with Philips and UPMC, has announced the launch of Cardeation Capital, a $30 million collaborative venture capital fund designed to spur healthcare innovation in heart disease and stroke care.

Epic Wins Labor Dispute in Closely Divided Supreme Court Decision

Epic Systems Corporation won a major labor-law ruling in the Supreme Court on Monday, centering around the extent of corporations’ right to force employees to sign arbitration agreements, and with a 5-4 ruling in its favor

Survey: Two-Thirds of Physician Practices Seeking Out Value-Based Care Consulting Firms

Most physician organizations are not prepared for the move to value-based care, and 95 percent CIOs of group practices and large clinics state they do not have the information technology or staff in-house needed to transform value-based care end-to-end, according to a recent Black Book Market Research.

Cumberland Consulting Buys LinkEHR, Provider of Epic Help Desk Services

Cumberland Consulting Group, a healthcare consulting and services firm, has acquired LinkEHR, which provides remote application support, including Epic help desk services.

Population Health Tool that Provides City-Level Data Expands to 500 Cities

A data visualization tool that helps city officials understand the health status of their population, called the City Health Dashboard, has now expanded to 500 of the largest cities in the U.S., enabling local leaders to identify and take action around the most pressing health needs in their cities and communities.