University of Miami

Two employees of the covered entity (CE), University of Miami Hospital, printed patients’ face sheets in excess of their job duties and sold them over a period of 19 months before the activity was discovered by police while on an unrelated house raid. Following notification by the police, the CE conducted an internal investigation and determined that the breach potentially involved the protected health information (PHI) of 64,846 individuals. The PHI involved in the breach included demographic and clinical information. The CE provided breach notification to HHS, affected individuals, and the media. It also applied sanctions to the involved employees. Following the breach, the CE disseminated educational material to the workforce and reviewed its HIPAA policies and procedures. It also deployed a program which monitors its electronic systems to safeguard against inappropriate use. OCR obtained assurance that the CE took the corrective actions listed above. The CE also confirmed its plan to continue to perform frequent access reviews, periodic audit trail reviews, and to create and retain audit logs for routine analysis.