SSM Health Patients Notified of Data Breach Involving Member of Staff

by | Jan 6, 2018

It has been discovered that a former member of staff at SSM Health has been accessing the health records of patients without any valid work reason for doing so for roughly eight months.

The former health worker was employed in the St. Louis, MO-based not-for-profit health system’s customer service call center, and as such, did not have verified access to financial data, only demographic, health, and clinical details.

The improper access was discovered by SSM health on October 30, leading to a thorough investigation to figure out what records had been accessed and which patients were possibly at risk. The investigation showed the records of patients in multiple states were seen by the employee int he time period from February 13 -October 20, 2017.

The employee was mainly interested in the details of patients of a primary care physician in the St. Louis area, particularly patients who had been prescribed a controlled substance. While that category of patients was relatively small, the organization was not in a position to determine the full scope of the privacy breach, so SSM Health took steps to notify all patients whose records had been accessed by the former member of staff. In many cases, that access will have been for valid work reaons.

Overall, 29,000 patients have been alerted of the breach incident and warned that their protected health details may have been improperly accessed and could potentially have been inappropriately used. Those patients have been offered identity theft protection services for free.

SSM Health has also amended its procedures to require an additional identifier to be used when patients ask for prescription refills through its call center. Internal policies and procedures have been re-assessed and employee access monitoring tools have been enhanced to ensure any future illegal employee activity is discovered more quickly.

The incident has been made known to the Department of Health and Human Services’ Office for Civil Rights (OCR)  and law enforcement has been advised of it as well.

SSM Health privacy officer, Scott Didion, stated, “We take very seriously our role of safeguarding our patients’ personal information, and we deeply regret any inconvenience or concern this situation may have caused our patients.”

This is the second consecutive incident to be identified by SSM Health within the last 12 months. In May, the group reported that an electromyography device including the PHI of 836 patients had been illegally obtained from DePaul Hospital based in St Louis.

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.

COMPREHENSIVE HIPAA TRAINING

Please enable JavaScript in your browser to complete this form.

Patrick Kennedy

Patrick Kennedy is a highly accomplished journalist and editor with nearly two decades of experience in the field. With expertise in writing and editing content, Patrick has made significant contributions to various publications and organizations. Over the course of his career, Patrick has successfully managed teams of writers, overseeing the production of high-quality content and ensuring its adherence to professional standards. His exceptional leadership skills, combined with his deep understanding of journalistic principles, have allowed him to create cohesive and engaging narratives that resonate with readers. A notable area of specialization for Patrick lies in compliance, particularly in relation to HIPAA (Health Insurance Portability and Accountability Act). He has authored numerous articles delving into the complexities of compliance and its implications for various industries. Patrick's comprehensive understanding of HIPAA regulations has positioned him as a go-to expert, sought after for his insights and expertise in this field. Patrick's bachelors degree is from the University of Limerick and his master's degree in journalism is from Dublin City University. You can contact Patrick through his LinkedIn profile:

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.

Comprehensive HIPAA Training

Used in 1000+ Healthcare Organizations and 100+ Universities

    Full Course - Immediate Access

    Privacy Policy