On December 27, 2016, Vanderbilt University Medical Center, the covered entity (CE), learned that a transporter employee in the Pediatric Emergency Department (PED) had accessed patients’ electronic medical records (EMR) without authorization. The breach involved the protected health information (PHI) of 3,247 individuals and included patients’ names, dates of birth, internal medical record numbers, clinical information, and for some records may have included social security numbers. In response to the breach, the CE sanctioned the involved employee (including termination in this case), reviewed its record audit procedures, removed EMR access for PED transporters, implemented an alternative process for PED transporters, and reviewed and edited its security policies. In addition, the CE provided retraining to departments utilizing a patient transport role. The CE provided breach notification to HHS, affected individuals, the media. OCR obtained assurances that the CE implemented the corrective actions listed above.
