TJ Samson Community Hospital

On August 25, 2017, the covered entity (CE), T.J. Samson Community Health, discovered that two employees from its affiliate, Anesthesiology Associates of Glasgow, PSC (“AAG”), impermissibly accessed protected health information (PHI) outside a legitimate job-related reason. The breach affected approximately 683 individuals and included names, dates of birth, Social Security numbers, diagnoses, medications, lab results, and insurance plan information. The CE provided breach notification to HHS, affected individuals, and the media. In response to the breach, the CE terminated the access credentials for both involved employees and they were sanctioned. Additionally, the CE revised and created new policies such as its Confidentiality Agreement Policy which requires any affiliated physician practice requesting access to PHI to enter into an access agreement providing assurances of confidentiality, compliance with HIPAA, and annual attestations. Furthermore, the CE reeducated its own staff as well AAG’s on employee access to PHI and HIPAA best practices. OCR obtained assurances that the CE implemented the corrective actions listed above. The involved employees no longer work for AAG.