Beacon Health System

Beginning on or around March 1, 2014, an employee of the covered entity (CE), Beacon Health System, impermissibly accessed Emergency Room (ER) patient records while working in the billing department. The employee had access to protected health information (PHI) for 1,239 ER patients, including addresses, dates of birth, names, social security numbers, ages, room numbers, claims information, billing, accounts, invoices, health insurance, illness, and chief complaint. The CE provided breach notification to HHS, affected individuals and the media. It also provided credit monitoring to affected individuals. Following the breach, the CE sanctioned the employee in accordance with its sanction policy. During our investigation, we found that a large number of the CE's staff either did not complete HIPAA training or only completed a portion of the training for 2016. OCR requested that the CE update its HIPAA training policy and audit policy. In response, the CE provided OCR with documentation of actions it took, including redrafting its HIPAA training policy, updating its audit policy and providing evidence of daily audits and log runs.