Mass General Brigham based in Boston, MA, reported the termination of two employees because of a privacy breach discovered on April 4, 2024. According to the investigation of the health system, the two employees permitted a third person, who wasn’t working at Mass General Brigham, to do part of their job responsibilities that may have allowed the viewing of patients’ personal data. The investigation finished on May 28, 2024, and revealed that the claimed offenses happened from February 26, 2024 to April 4, 2024.
The Health Insurance Portability and Accountability Act (HIPAA) requires the security of protected health information (PHI) all the time and forbids sharing of PHI to unauthorized persons except if legitimate authorization was acquired from the people involved ahead of time. Mass General Brigham’s work and privacy policies stated that violation of those guidelines by the employees entails immediate termination of the employees. Mass General Brigham didn’t mention anything about the relationship between the terminated employees and the third person.
The investigation affirmed that the data possibly accessed included names, addresses, birth date, telephone numbers, medical record numbers, email addresses, and medical insurance policy numbers. Clinical data, such as data about their appointments or admissions to Mass General Brigham services, reason for the consultation, diagnosis, date of visit/admission, and location could have been accessed as well. The Social Security numbers and/or financial data, and some guarantor details of some impacted patients were also exposed. Mass General Brigham stated that no financial account numbers of the impacted persons were exposed.
Mass General Brigham stated besides firing the workers, steps were taken to avoid the same occurrences later on, which included improving its employee HIPAA training and the protocols for its security alert program. As a safety measure against identity theft and fraud, the health system offered the impacted patients free 24-month credit monitoring and identity theft protection services via IDX.
The HHS Office for Civil Rights (OCR) received two reports of unauthorized access/disclosure breaches on June 28, 2024. Mass General Brigham Health Plan submitted one report with 3,659 individuals affected. Mass General Brigham Incorporated submitted the other report with 655 individuals affected.
