Covenant Medical Center

The covered entity (CE), Covenant Medical Center discovered that an employee accessed patients’ electronic medical records from February 1, 2016 through November 21, 2016 without an appropriate business purpose. This breach affected the clinical, demographic, and financial information of approximately 6,197 individuals. The CE provided breach notification to HHS, affected individuals, and the media. It also offered affected individuals credit monitoring. Following the breach, the CE sanctioned the involved employee and retrained staff. OCR obtained assurances that the CE implemented the corrective actions listed above. In this case the sanctions included termination of employment.