On July 7, 2014, Memorial Hermann Health System's audit program identified that a workforce member had inappropriately accessed the protected health information (PHI) of approximately 10,600 individuals. The covered entity (CE) provided breach notification to HHS, affected individuals, and the media. It also promptly terminated the involved workforce member. OCR reviewed copies of the CE's policies and procedures related to the incident and information related to its HIPAA training program and audit protocols in place at the time of the incident. Following the incident, the CE took corrective actions including expanding its IT audit program and hiring additional audit staff.
