It has been discovered that a former member of staff at SSM Health has been accessing the health records of patients without any valid work reason for doing so for roughly eight months.
The former health worker was employed in the St. Louis, MO-based not-for-profit health system’s customer service call center, and as such, did not have verified access to financial data, only demographic, health, and clinical details.
The improper access was discovered by SSM health on October 30, leading to a thorough investigation to figure out what records had been accessed and which patients were possibly at risk. The investigation showed the records of patients in multiple states were seen by the employee int he time period from February 13 -October 20, 2017.
The employee was mainly interested in the details of patients of a primary care physician in the St. Louis area, particularly patients who had been prescribed a controlled substance. While that category of patients was relatively small, the organization was not in a position to determine the full scope of the privacy breach, so SSM Health took steps to notify all patients whose records had been accessed by the former member of staff. In many cases, that access will have been for valid work reaons.
Overall, 29,000 patients have been alerted of the breach incident and warned that their protected health details may have been improperly accessed and could potentially have been inappropriately used. Those patients have been offered identity theft protection services for free.
SSM Health has also amended its procedures to require an additional identifier to be used when patients ask for prescription refills through its call center. Internal policies and procedures have been re-assessed and employee access monitoring tools have been enhanced to ensure any future illegal employee activity is discovered more quickly.
The incident has been made known to the Department of Health and Human Services’ Office for Civil Rights (OCR) and law enforcement has been advised of it as well.
SSM Health privacy officer, Scott Didion, stated, “We take very seriously our role of safeguarding our patients’ personal information, and we deeply regret any inconvenience or concern this situation may have caused our patients.”
This is the second consecutive incident to be identified by SSM Health within the last 12 months. In May, the group reported that an electromyography device including the PHI of 836 patients had been illegally obtained from DePaul Hospital based in St Louis.