Our Lady of the Angels Hospital

A workforce member impermissibly accessed the protected health information (PHI) of approximately 1,140 patients for more than three years. The types of PHI involved in the breach included clinical, demographic, and financial information. Following the breach, the covered entity (CE) notified HHS, affected individuals, and the media and provided free credit monitoring for a year. As a result of OCR’s investigation, the CE sanctioned the workforce member involved, implemented a system for monitoring workforce members’ access to PHI, retrained its workforce members on the Privacy and Security Rules, and updated its risk analysis and risk management plan. Further, the CE updated and modified its substitute notice and media notice concerning the breach. OCR provided technical assistance and obtained assurances that the CE implemented the corrective actions noted above.