Meritus Medical Center

The covered entity (CE), Meritus Medical Center, reported that an audit revealed that a vendors’s employee (from Walgreens pharmacy) accessed the protected health information (PHI) of approximately 1,029 patients without a business need to do so. The types of PHI potentially accessed included demographic information such as names, dates of birth, medical record numbers and, in some instances health insurance information or Medicare identification numbers, as well as clinical information. The CE confirmed that it terminated the employee’s access to the electronic health record (EHR) and escorted the employee from the Meritus campus. The CE provided breach notification to HHS, the media, and affected individuals and offered credit monitoring. The CE implemented a new system for implementing technical measures so that the vendor’s employees’ access is limited to a separate system that interfaces with the EHR and pulls only limited patient information specifically related to those patients receiving Walgreens’ services. OCR obtained assurances that the CE implemented the corrective actions listed.