Glendale Adventist Medical Center

A workforce member of the covered entity (CE), Glendale Adventist Medical Center, an Adventist Health facility, inappropriately accessed medical records for several months from the employee’s personal electronic device(s) via a remote connection. The breach affected 528 individuals’ electronic protected health information (ePHI) and included patients’ names, addresses, dates of birth, social security numbers, and medical diagnoses. The CE provided breach notification to affected individuals, the media, and HHS. Following the breach and in response to OCR’s contact in this matter, the CE sanctioned the employee and revised its sanctions policy. OCR obtained assurances from the CE that it took the corrective actions noted above. The CE also reported to OCR that it planned to take measures to increase its administrative and technical safeguards of ePHI. In this case, the CE’s sanction included termination of employment.