Providence Medical Group- Gateway Clinics

In July 2016, the covered entity (CE), Providence Medical Group – Gateway Clinics, reported that its privacy monitoring program discovered inappropriate access to medical records by one its financial coders. The audit revealed that the employee had impermissibly accessed the medical records of 5,977 individuals. The types of protected health information (PHI) involved in the breach varied by patient, but could have included demographic and medical treatment information, and may have included images of driver's licenses, insurance data and Social Security numbers. The CE provided breach notification to HHS, affected individuals, and the media and also offered individuals two years of credit monitoring. Following the breach, the CE sanctioned the employee and disabled electronic and physical access to its systems. The CE also retrained coders on its privacy policies and reviewed its risk assessment and risk management plan. OCR obtained assurances that the CE implemented the corrective actions listed above.