An employee who improperly viewed thousands of patient records no longer works at Ann & Robert H. Lurie Children's Hospital of Chicago, the hospital said.
Lurie Children's on March 5 discovered that over the course of more than a year—between November 2018 and February 2020—the now former employee "may have accessed certain medical records without a work-related reason," according to a notice the hospital posted online this week.
The incident involved the medical records roughly 4,800 patients, according to a report Lurie Children's made to HHS' Office for Civil Rights on Monday. HHS gives HIPAA-covered entities 60 days from when they discover a breach to notify the department.
Lurie Children's said the hospital terminated the unnamed employee's access to the organization's systems upon learning of the data breach.
The employee no longer works for the hospital.
After an investigation, Lurie Children's determined the employee had accessed information including patients' names, addresses, dates of birth and medical information, such as diagnoses, medications, appointments and procedures. The access did not include full Social Security numbers, insurance information or financial account information.
Lurie Children's said it's found no evidence to suggest the employee had misused or released any of the patient information. The hospital's notice did not include information on the employee's reasons for viewing the patient records.
"We want our patients to know that we are taking this matter very seriously," reads the notice. "To help prevent something like this from happening in the future, we are retraining our staff regarding appropriate access to patient records and enhancing our monitoring capabilities."
Lurie Children's notified patients about a similar incident late last year, according to the Chicago Tribune.
In the 2019 incident, Lurie Children's said it in November discovered that an employee had accessed an undisclosed amount of patient records without authorization between September 2018 and September 2019. Lurie Children's fired that employee, the Chicago Tribune reported in December.
Lurie Children's did not immediately respond to a request for comment.
