Arkansas Childrens Hospital

Law enforcement notified the covered entity (CE) that a former workforce member fraudulently used patients’ Social Security numbers and other demographic information. The workforce member had access to 4,521 patients’ protected health information (PHI) to perform the essential functions of the job. Following the breach, the CE began revising its policy to incorporate a renewed background check of its workforce every three years. In addition, the CE implemented an access monitoring process which audits access to its patients' records and reports questionable recent activity and the date of activity, and provides a platform for documenting breach incident assessments and investigations. The CE provided breach notification to HHS, affected individuals, and the media and offered one year of free credit monitoring. OCR obtained assurances the CE implemented the corrective actions listed above.