Memorial Health Systems

On July 12, 2011, the covered entity (CE), Memorial Health System (now doing business as Memorial Hospital – University of Colorado Health) submitted a breach report explaining that a former Colorado Springs Occupational Health Clinic (CSOHC) nurse impermissibly accessed over 2,330 individuals’ medical records between 2003 and May 2011. To carry out these impermissible accesses, the nurse utilized a web-based electronic health record (EHR) application that was owned and operated by the CE and utilized by several Colorado Springs area providers, including the CSOHC. The CE provided breach notification to HHS, the media, and affected individuals. Based on the breach and OCR’s investigation, the the CE terminated the former CSOHC nurse’s access to the EHR and ultimately replaced the EHR. The CE developed and implemented several new Privacy and Security Rule policies and procedures, conducted institution-wide HIPAA training, implemented stricter audit controls, and implemented an information system activity review mechanism. Additionally, the involved nurse resigned from CSOHC. OCR has consolidated the unresolved issues from this breach into another review of this CE.