Employee Abuses Access to Boone Hospital Patient Information
COLUMBIA - KOMU 8 News obtained a letter from a Boone Hospital patient Monday in which the privacy director admitted an employee affiliated with the hospital abused their access to a network containing patient information.
Privacy director Kathleen Pitzer wrote several patients last week, saying she became aware of an information breach on Sept. 18. The hospital said an employee working for a physician clinic was responsible.
KOMU 8 News learned about the information breach from a Hallsville woman who received the letter last week. The woman said she knows of several people in the area who received the letters and many are family members or friends.
The woman's sister is Sturgeon resident Lakeya Keil. Keil received a letter Oct. 16 and said she knows who the employee is. Keil believes the employee acted out of ill will toward her family and friends.
Keil received the letter nearly a month after the breach and said she feels the hospital should have let her know about the incident sooner.
"It frustrates me because they are downplaying this and basically saying that it was just a curiosity thing and that there was no harm intended," Keil said. "And I don't know how they can speak for that because I can't answer why this individual looked into our health records."
Pitzer said a patient called Sept. 16 and reported that she believed an employee of a staff physician had inappropriately accessed her personal health information.
Pitzer said Boone Hospital looked at the employee's access history and confirmed she had access to personal health information like social security numbers and birth dates. Pitzer said the employee also had access to treatment-related records such as prescribed treatment and diagnoses.
Pitzer said Boone Hospital terminated the employee's access to the network Sept. 19 after it concluded its investigation.
The hospital apologized for the incident and is allowing anyone affected to enroll in a one-year credit monitoring program, which Boone Hospital will pay for.
Media relations spokesman Jacob Luecke issued a statement to KOMU 8 News regarding the information breach.
"The hospital and the practice cooperated on an immediate investigation and have taken appropriate action regarding the practice's employee," Luecke wrote. "Any patient whose record may have been accessed has been notified."
Luecke wrote that protecting patient privacy is a critical responsibility for hospital employees. Luecke said he believes about 125 people were affected. Luecke said it took awhile to respond because it took time to find who was affected after the hospital finished its investigation.
Keil said she does not believe the hospital has done enough to punish the employee and believes the worker should be apprehended in some way for a HIPAA violation.