Kaiser Foundation Health Plan of the Mid-Atlantic States, Inc. reported that it discovered that unauthorized access to its electronic health record system may have exposed the patient information of more than 8,500 individuals.
“On September 21, 2022, Kaiser Permanente determined that one of its employees inappropriately accessed portions of a patient’s medical records in the Mid-Atlantic region without a basis. reasonable.
“An investigation has determined that former employees’ access is outside the scope of their authorized job functions,” according to the notice the healthcare provider posted on its website.
While there is no social security number or financial information associated with this incident, there is no evidence that the information accessed – patient demographics and medical information, including including photos – were shared or used to commit fraud, the company said in the statement.
After an internal investigation, the employee no longer works for the company.
In addition to reporting unauthorized access to federal agencies, the company said it is reviewing policies that manage access to patient medical records and has sent letters to affected patients. .
Earlier this year, the Healthcare Cybersecurity Coordination Center released a threat summary of potential EHR cybersecurity risks, ranging from phishing attacks to malware. and overlooked encryption vulnerabilities to cloud and employee threats.
“Healthcare leaders should understand where operational vulnerabilities exist in their organizations, from marketing to critical health records,” said Department of Health and Human Services’ network agency. United States said.
Andrea Fox is the senior editor of Healthcare IT News.
Email: [email protected]
Healthcare IT News is a publication of HIMSS.
