Nurse Snooping and the Four-Factor Breach Test
Lakeshore Regional Hospital has 300 beds and a mature EHR. A patient complaint prompts an audit: a night-shift nurse accessed 14 patients' records over two months. None of the 14 was assigned to her, and 11 were celebrities or local officials. The audit shows she viewed demographics, diagnosis, and visit history but did not print, download, email, or forward any record. She was terminated and admitted curiosity. The privacy officer wants to notify all 14 patients; the general counsel argues there was no disclosure because nothing left the hospital and no one else saw the data. The hospital's breach response policy says unauthorized access is presumed a breach unless a four-factor risk assessment shows low probability of compromise. State law requires notification for unauthorized acquisition of personal information, with a risk-of-harm exception. The compliance committee meets in three days.
1. Apply the four-factor risk assessment and decide whether notification is required.
Read the worked answer
The general counsel's argument is wrong for HIPAA purposes because breach includes unauthorized acquisition, access, use, or disclosure, and viewing records is access. Start with the presumption in policy. Factor one: the data includes diagnosis and visit history for 14 identifiable patients, including celebrities and officials, so sensitivity and extent are meaningful. Factor two: the nurse was a workforce member but had no treatment, payment, or operations relationship with these patients, so the access was unauthorized. Factor three: she viewed the records, and viewing is acquisition even without printing or emailing. Factor four: termination and monitoring reduce further disclosure, but the information cannot be unseen and the motive was curiosity, not care. The risk of harm includes embarrassment, reputational damage, and potential discrimination. On these facts the hospital cannot document a low probability of compromise, so notification is required. The 14 patients should be notified promptly; HHS gets an annual log because fewer than 500 individuals are affected in the state, and state attorney general or other notices apply if state law says so. Document the assessment and the notification decision.
2. What workforce and monitoring controls should follow this incident?
Read the worked answer
The control gap is not just one nurse; it is the ability to access 14 unrelated records over two months without detection. Implement role-based access and minimum necessary permissions, especially for VIP or celebrity patients. Use break-glass access with real-time alerts and mandatory reason entry, then review every break-glass event. Run exception reports on employees accessing patients outside their assigned unit or with no treatment relationship, and review them at least monthly. Add periodic access recertification and termination checklists. Update the sanction policy and apply it consistently; the nurse's termination is appropriate, but the policy must be known before the event. Train staff on privacy expectations and how to report snooping. Give the privacy officer authority to investigate complaints promptly. Track metrics such as audit reviews completed, unauthorized-access alerts, and time to resolve. These controls address the specific behavior while preserving clinicians' ability to deliver emergency care.