Penn Medicine

An employee of a staffing agency who was placed at the covered entity (CE) was arrested for fraud and the CE subsequently determined that she impermissibly accessed and used at least one patient’s protected health information (PHI) and potentially affected the PHI of 917 individuals. The types of PHI involved in the incident included names, dates of birth, social security numbers, and clinical information. The CE provided breach notification to HHS and all potentially affected individuals, including patients whose records were likely accessed by the employee to complete her job duties. Following the breach, the CE required its staffing agencies to conduct more vigorous background checks for employees placed at the CE. OCR reviewed the CE’s response to this incident which included the business associate agreement.