VIP Record Snooping and HIPAA Breach Decision
During a routine access-log review, the privacy officer at a 400-bed hospital finds that 14 workforce members accessed the electronic record of a celebrity patient over three days. Two employees work in environmental services and had no treatment, payment, or operations relationship to the patient. The record includes diagnosis, medication list, and behavioral-health notes. Access occurred from the emergency department, operating room, and a remote workstation. The hospital uses role-based access but has no break-glass or real-time monitoring. The CEO asks internal audit to lead the investigation and advise on notification.
1. Determine whether this is a HIPAA breach and what notifications are required.
Read the worked answer
Access by workforce members without a treatment, payment, or operations purpose is an impermissible use or disclosure under HIPAA. A breach is presumed unless the organization demonstrates a low probability of compromise using the four factors: the nature and extent of the PHI, the unauthorized recipient, whether the PHI was actually acquired or viewed, and the extent of mitigation. Here the record includes diagnosis, medications, and behavioral-health notes; the recipients were employees; audit logs show access; and mitigation was after the fact. The presumption is therefore difficult to overcome. Notify the patient without unreasonable delay and no later than 60 days after discovery. Because 14 individuals are affected-fewer than 500-report to HHS on the annual breach log, not concurrently, unless state law requires otherwise. Behavioral-health data may trigger stricter state notification. Legal counsel should review before notification.
2. Design the investigation and workforce sanctions.
Read the worked answer
Preserve audit logs and devices, interview the 14 employees, and determine each person's role and purpose. ED and OR staff may have had a legitimate treatment relationship; environmental services staff likely did not. Review whether any information was further disclosed, photographed, or sold. Apply the workforce sanction policy consistently: termination for intentional snooping, progressive discipline for negligence, and retraining where appropriate. Document the investigation and the basis for each decision. Check whether the patient's record was accessed by others and whether similar VIP or employee snooping occurred. Notify law enforcement if there is theft or identity fraud. Avoid retaliating against good-faith reporters. Report findings to the privacy board and CEO.
3. Recommend access controls and monitoring.
Read the worked answer
Implement role-based access with minimum necessary permissions, break-glass access requiring a reason, and real-time alerts for VIP, employee, and behavioral-health records. Retain audit logs and review them proactively. Conduct quarterly access recertification, terminate access promptly, and reconcile user lists. Add privacy training, a mystery-patient program, and a clear sanctions policy. Restrict remote access and require multifactor authentication. Report access-monitoring metrics to the audit committee. These controls support the HIPAA Security Rule audit-control requirement and reduce the risk of repeat snooping.