Children's Heart Center

An employee was arrested on-site for suspicion of identity theft after using electronic protected health information (ePHI) obtained while employed by the covered entity (CE) to open a credit card account in another individual’s name. The employee had a criminal history which was not identified during the CE’s hiring process. The CE provided breach notification to HHS, affect individuals, and the media. It also cooperated with the subsequent law enforcement investigation. Following the breach, the CE sanctioned the employee and terminated and replaced its vendor for background checks of potential employees. The CE also improved its physical security, enhanced technical safeguards for ePHI, formed a committee to formalize written policies for safeguarding ePHI, and enhanced staff training. OCR obtained assurances that the CE implemented the corrective actions noted above.