UPDATE: Employee fired after more than 750 medical records accessed without authorization at EIPH

UPDATE

EastIdahoNews.com contacted Eastern Idaho Public Health to ask how many records were accessed during what timetable. This is the response we received:

The records were accessed from September 2022 to November 2024. The number of records accessed was 759 records.

For context, HIPAA always requires media reporting within 60 days when more than 500 individuals are impacted, which EIPH has done. Upon suspected report of unauthorized access, EIPH launched an investigation immediately.

Again, as a result of the investigation, we have reinforced education with our staff, clarified policies and procedures regarding access to records, as well as taken action to the staff member involved.

We regret this situation occurred for those who had their privacy violated. We have processes and systems in place to protect privacy and confidentiality. Sadly, no system can be perfect, and we rely on the integrity of individual employees in addition to the security and training that is in place.

ORIGINAL STORY

The following is a news release from Eastern Idaho Public Health.

IDAHO FALLS — At Eastern Idaho Public Health, we are committed to protecting the privacy and security of our patient’s information. Regrettably, we identified a privacy incident involving some of that information.

Recently, we learned that one of our employees may have accessed protected health information without authorization. An investigation was launched immediately when unauthorized access was suspected. The investigation involved a review of access logs of patient records and interviews with staff.

The investigation determined some medical records were accessed without authorization, specifically access of patient clinic notes. The information included health screenings, histories, assessments, orders, and results. We were able to determine that no copies, transcriptions, or recordings were taken of the protected health information. The information did not involve any immunization records, financial, or insurance information. Eastern Idaho Public Health is confident that access of the medical records was not for malicious purposes and there is no indication that any patient data will be misused.

Notification letters were sent to patients whose information was accessed to inform them of the violation and further steps to protect their information. The letter included methods of contact should patients have questions about the incident. Patients may contact us with questions at 1-855-533-3160 (toll free) or (208) 533-3217.

We regret any concerns or inconvenience this incident may cause and remain committed to protecting the confidentiality and security of patient information. As a result of the investigation, Eastern Idaho Public Health has reinforced education with our staff, clarified procedures regarding access to records, and has terminated the staff involved.