Massachusetts Department of Public Health - Tewksbury Hospital

An employee of Tewksbury Hospital, a covered component of the Massachusetts Department of Public Health, the covered entity (CE), impermissibly access the electronic medical records of 1,176 individuals. The types of protected health information (PHI) involved included demographic and clinical information. The CE provided breach notification to HHS, affected individuals, and the media and posted substitute notice on its website. The employee resigned before the CE could apply sanctions. Following the breach, the CE removed sensitive information from the patient summary page in its electronic medical record (EMR) system, increased restrictions to EMR access based on workforce member role and work location, and provided additional training to all its employees regarding role-based access and the HIPAA minimum necessary requirements. OCR reviewed the CE’s policies and procedures and obtained assurances that the CE implemented the corrective actions listed above.