Huntington Hospital

Huntington Hospital, the covered entity (CE), reported that an employee impermissibly accessed the electronic medical records of 12,925 individuals. The protected health information (PHI) involved included names, addresses, dates of birth, telephone numbers, diagnoses, medications, laboratory results, and other treatment information. The CE notified HHS, affected individuals, the media, and posted substitute notice on its website. In its mitigation efforts, the CE sanctioned the employee, provided complimentary credit monitoring services, and implemented additional administrative and technical safeguards to protect PHI. Staff were retrained.