Case Study 4:

Your facility recently had a privacy violation.

Terry, a former employee, had been terminated 6 weeks ago. Apparently, Terry had a grudge against the hospital, so he went into the Radiology information system, downloaded PHI, and then posted it on his personal website.

One of the current employees, Sean, who knew Terry, just happened to surf his website to see if it said what he was doing now. Sean saw an inflammatory story about the hospital and some PHI posted on Terry’s website. Sean immediately reported the breach to the Privacy and Security Officer at the facility.

Refer to our Fundamentals of Law text Figure 10.2 “Key components of an information security checklist”, and write about the following (1-2 pages should be plenty):

1. What legal issues are involved? The case involves the violation of the HIPAA Security Rule and HITECH provisions. The legal issues here is the former employee still have the access to logon to a system that contains the PHI. They system allows Terry to download PHI from an outside network and printer, and Terry disclose the information to a public social media.
2. What corrective action steps would the facility need to take following its investigation? At first, Terry’s access should be terminated immediately for preventing future unauthorized logon. Then, the officer should use the audit logs to check the detailed information about who access the system and review the PHI. Since Terry’s access still exists, the facility need to check if there has any other former employees still have the valid password to enter the system. All current employees need to take the training about the security awareness and use the example to prevent the violation and report the violation. The training should address all current policies and laws of the privacy and security of the PHI. Also, the employees