Hospital Insider Breach Lasted 10 Years, Led to FBI Inquiry

Harris Health is contacting 5,000 patients about a breach involving a former employee who improperly accessed electronic health records for over a decade. The Texas healthcare organization said it learned of the incident and reported it to the FBI four years ago.

See Also: OnDemand | Transform API Security with Unmatched Discovery and Defense

The Harris Health employee accessed patients EHRs without a work-related reason from Jan. 4, 2011, to March 8, 2021. The healthcare entity said it “learned” of the incident on Feb. 10, 2021, “quickly” launched an investigation with assistance from a forensic firm, reported the incident to law enforcement and terminated the employee.

Houston-based Harris Health, which operates two trauma center hospitals and a network of 37 clinics, health centers and specialty locations, said on Friday the FBI had just given the entity the green light to begin notifying patients.

“While working with law enforcement, Harris Health determined that the former employee disclosed some patient information to unauthorized individuals,” the healthcare firm said.

“Because it could have impeded their investigation, law enforcement required Harris Health to delay notifying patients of this incident. Harris Health is now notifying patients as quickly as possible after receiving permission from law enforcement to do so,” Harris Health said in a privacy breach notice.

“To date, Harris Health has not been able to determine which specific patients’ information was disclosed outside the organization but is notifying all patients whose electronic medical records may have been impermissibly accessed by the former employee.”

Potentially compromised information includes name, date of birth, address, email address, telephone number, medical record number; clinical information, diagnoses, medical history, medications, immunizations, provider name, dates of service and insurance information. The breach also affected Social Security numbers of some patients.

Harris Health said it is offering complimentary identity and credit monitoring to patients whose Social Security numbers were compromised.

Harris Health declined to provide Information Security Media Group additional details about the incident. The FBI did not immediately respond to ISMG’s request for details about the case, including the status of the investigation and whether anyone was charged in the incident.

The apparent four-year delay in law enforcement allowing Harris Health to notify affected patients seems longer than typical investigations, some experts said.

“We don’t have insight into why law enforcement needed that much time,” said Keith Fricke, principal consultant at privacy and security consultancy tw-Security.

“It depends on what they uncovered in their investigation, which may have involved more than inappropriate access to electronic protected health information – other criminal activity may have been at play,” he said.

Taking Action

In any case, healthcare organizations can take steps to help better prevent and more quickly detect improper access by staff to EHRs.

“Access to regulated PHI must be strictly controlled by a need to know. That said, anyone with access to the EHR system can potentially peruse records,” said Mike Hamilton, field CISO at security firm Lumifi Cyber. For instance, health records for celebrities or other VIPs are sometimes accessed by those who are “curious,” and this information is sometimes shared with friends and family, he said.

“To ensure that records are only accessed by those involved with the healthcare of the individuals whose records are in question, role-based identity and access management must be used,” he said. “That access must be reauthorized on a quarterly basis; and access routinely audited to identify aberrational access, such as by someone with access to the EHR but not for specific patient records.”

Healthcare organizations should invest in technology that collects event logs from PHI systems, looks for suspicious access activity and sends alerts, Fricke said.

“These systems can detect activities such as a user account viewing PHI of a patient with the same last name, a patient whose address is within a specified geographic area of where the employee lives, logins to PHI systems during times when an employee normally is not working,” he said.

A good practice is for healthcare organizations to periodically remind employees that activities in ePHI systems are being monitored, he said. “Periodic manual audits should be conducted, either reviewing which users accessed randomly selected patients or reviewing which patients a randomly selected group of users accessed within a defined timeframe, documenting the results, including any corrective actions for inappropriate access.”

Regulatory Wrath

Federal regulators in recent years have taken enforcement actions against a handful of HIPAA-regulated organizations involving insider breaches.

That includes the U.S. Department of Health and Human Services lodging a $1.9 million civil monetary penalty last year against Gulf Coast Pain Consultants, which does business as Clearway Pain Solutions Institute, after an investigation into an insider breach the practice reported in 2019 affecting nearly 35,000 people (see: Insider Breach, Email Attacks Net $1.7M in HIPAA Fines).

HHS’ Office for Civil Rights’ investigation into the pain management practice focused on a former independent business consultant who was under contract. The contractor was accused of accessing the practice’s electronic health records and patients’ protected health information to commit Medicare claims fraud.

More recently, HHS OCR in May said BayCare Health System, a Florida health organization, agreed to pay a $800,000 financial settlement and implement a corrective action plan to settle a federal HIPAA investigation into a malicious insider incident involving a patient’s medical records in 2018 (see: Florida Health System Pays $800K for Insider Record Snooping).

In that case, the complainant, a BayCare patient, alleged that in October 2018, an unknown third-party accessed her printed and electronic medical records. Regulators said the patient alleged that, following treatment she received at the BayCare facility, she was contacted by “an unknown individual who had photographs of her printed medical records, as well as a video of someone scrolling through her medical records on a computer screen.”

The investigation found that credentials used to access the patient’s electronic medical records belonged to a former non-clinical staffer at a medical practice that had access to BayCare’s electronic medical records.

“The failure to log and review or audit EHR records is a common limitation that prevents detection of improper access, as is the failure to train employees on what is permissible and prohibited, given their extraordinary ability to review patient records,” Hamilton said.

“Since access must be afforded to those that provide care to patients, the process involved is more important than technology solutions,” he said.

EHR systems may be configured with custom roles, such that someone in billing can only access that information and not the details of care, he said. “However, regular audits, user training and having clear policies on access limitations are key practices that should be pervasive across covered entities.”

Laziness and shortcuts are other problems that can come back to haunt healthcare organizations in insider breach cases, some experts said.

“It is a common practice when creating a new user account to copy the access profile of another worker, rather than building it from scratch,” Fricke said.

“Suppose ‘John Smith’ has been working at a hospital for 10 years and has changed jobs internally a few times during his tenure. Also suppose that as ‘John’ moved into new roles, his old access was not adjusted,” he said. “Now ‘Jane Doe’ is hired, and her assigned access is a copy of ‘John Smith’s’ access profile. Jane has now inherited 10 years of John’s access, some of which is not required for her job,” Fricke said.

Among other things, this type of situation violates HIPAA’s “minimum necessary” requirements for access to PHI, he said. “Sharing usernames and passwords into ePHI systems can lead to unauthorized access as well.”