Chadron Community Hospital and Health Services

The covered entity (CE), Chadron Community Hospital, reported that an employee impermissibly accessed the protected health information (PHI) of approximately 702 individuals. The PHI involved included names, addresses, dates of birth, diagnoses/conditions, lab results, medications prescribed, and other treatment information. The CE notified HHS, the affected individuals, the media, and established a toll-free number for questions or concerns. In its mitigation efforts, the CE sanctioned the employee, implemented administrative and technical safeguards and retrained its staff. OCR obtained assurances that the CE implemented the corrective actions noted.