Two former employees of the covered entity (CE), Sentara Healthcare, accessed protected health information (PHI) outside of their normal job duties and used this information to process fraudulent tax returns. The US Attorney’s office investigated the matter and both individuals received prison sentences. The breach report indicated that the PHI of approximately 3,645 individuals was involved in the breach; however, the CE verified that the final count of affected individuals was 3,891. The CE provided breach notification to HHS, affected individuals, and the media. The CE also offered complimentary credit monitoring and identity theft protection services to all eligible individuals. Following this incident, the CE increased safeguards by installing a new software system to help monitor and detect inappropriate access to its electronic medical records system, updated its security policies and procedures, re-trained employees, and initiated steps to address and mitigate the issues identified in its 2014 risk analysis. OCR obtained assurances that the corrective actions listed above were completed and/or initiated as described.
