Alexian Brothers Medical Center

On April 13, 2015, several files containing electronic protected health information (ePHI) were discovered on computers accessible to the public in the medical library at the covered entity (CE), Alexian Brothers Medical Center. The files included the first and last names, medical record numbers, and medication information related to 618 patients, and other clinical information for 14 patients. Approximately 632 individuals were affected by this breach. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach the CE posted signs noting that the computers were “public computers” and not to save files on the device, secured computers so that no data could be saved onto the virtual desktop or the hard drive, and essentially rendered folders as “read only”. The CE also implemented a process to track user access on all but one of the public computers. The CE retrained workforce groups involved in the breach. OCR obtained documented assurances that the CE implemented the corrective actions listed above.