Kennewick General Hospital

On May 26, 2017, the covered entity (CE), Kennewick General Hospital d/b/a as Trios Health, reported that one of its workforce members impermissibly accessed protected health information (PHI) that was outside the scope of the job responsibilities. The breach potentially affected 1,603 individuals. The types of PHI involved in the breach included patients' names, social security numbers, addresses, dates of birth, driver’s license numbers, lab results, medication information, treatment information, diagnoses and medical conditions. Following the breach, investigated the breach, sanctioned the involved workforce member, and implemented safeguards, including placing additional restrictions on access to PHI. As a result of OCR’s investigation, the CE conducted a review of its policies and procedures to determine the potential risks to its PHI and electronic PHI, revised its policies, and retrained its workforce.