Palomar Health

On February 10, 2016, the covered entity (CE), Palomar Medical Center, discovered that a PMC- Escondido Emergency Room (ER) nurse accessed the medical records of patients without a work-related reason to do so. The types of protected health information (PHI) involved in the breach included the demographic and clinical information of approximately 1,309 individuals. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE implemented new technical safeguards, provided individuals with free credit monitoring, and sanctioned the workforce member. As a result of OCR’s investigation, the CE restricted the ER nurse from having access to its facilities, patients, and the electronic medical record. The CE reported the matter to the Board of Registered Nursing (BRN) and the California Department of Public Health (CDPH). The CE’s Information Security Office circulated an information security awareness sheet related to unauthorized access via email to all employees and began implementing a new functionality of the Fair Warning tool: a report that runs daily and identifies disproportionate instances of access to patient medical records by st