Figure at center of UCLA medical records flap was just 'nosy'

[InfoSec News <alerts () infosecnews org>]

http://www.latimes.com/news/printedition/california/la-me-ucla9apr09,1,925908.story

By Charles Ornstein
Los Angeles Times 
Staff Writer
April 9, 2008

The UCLA Medical Center employee who allegedly pried into the private 
medical records of the governor's wife and 60 others in a burgeoning 
scandal was a low-ranking administrative specialist who told The Times 
on Tuesday that "it was just me being nosy."

"Clearly I made a mistake; let's put it like that," Lawanda J. Jackson, 
49, said when asked in a telephone interview why she improperly looked 
at the records of so many patients, including California First Lady 
Maria Shriver and actress Farrah Fawcett.

"I didn't leak anything or anything like that," said Jackson, who had 
worked at the hospital since she was 16. "It wasn't for money or 
anything. It was just looking."

UCLA took steps last May to fire Jackson after determining that she had 
inappropriately accessed dozens of electronic medical records, UCLA 
officials say. But the employee resigned in July before she could be 
fired, spokeswoman Roxanne Moster said. (Previously, the hospital told 
The Times that it had fired Jackson.)

Neither UCLA nor state health officials have confirmed Jackson's 
identity, but The Times was able to verify it.

The breaches have triggered several state investigations and created a 
major embarrassment for UCLA. The hospital could face serious sanctions 
from the California Department of Public Health, and Jackson could face 
criminal charges for allegedly violating a federal privacy law.

Although such charges are uncommon, federal prosecutors in Los Angeles 
have launched a preliminary inquiry into the matter, a source in the 
U.S. attorney's office said Tuesday.

"We're certainly interested and we're looking into it," said the source, 
who asked not to be named because he was not authorized to speak 
publicly about the case.

Among the 61 patients whose records Jackson allegedly viewed in 2006 and 
2007 were 33 celebrities, politicians and other well-known people, state 
officials have said.

UCLA's ability to keep patients' information private has been at issue 
since The Times reported last month that the university was trying to 
fire 13 workers and was disciplining 12 others for peeking into the 
records of pop star Britney Spears, who was hospitalized in its 
neuropsychiatric unit in January.

Lawyers for Fawcett contend that UCLA employees might have leaked or 
sold information on the recurrence of the actress' cancer last May to 
the tabloids, including the National Enquirer. The Enquirer published 
several sensational stories soon after her visits to the medical center, 
the lawyers said, including a piece titled "Farrah's Cancer Is Back!" 
before Fawcett was able to tell her son about it.

Through UCLA, the lawyers asked for a meeting with Jackson last year, 
but she declined. (Fawcett's lawyers did not know Jackson's name at the 
time but wrote to her as "Jane Doe.")

In the interview with The Times, Jackson would not say whether she had 
ever spoken to the Enquirer. "I'm not going to answer that," she said. 
"I'm scared to answer that. . . . I know I'm not the leak. I don't 
believe I'm the leak."

She dismissed questions about whether she had a financial motive to sell 
information. According to court records, Jackson and her husband, 
Victor, filed for bankruptcy protection in 2001, listing assets of less 
than $23,000 and liabilities of $37,300. But she said, "that was a long, 
long, long time ago." In the 2001 filing, she listed her job at UCLA; 
her husband said he was disabled.

Fawcett's lawyer said UCLA officials notified him of Jackson's name 
Monday evening after The Times made inquiries to the medical center 
about employees named Jackson.

"We had been asking for the name for nine months and they refused to 
give it to us and last night at 6 p.m. they gave it to us," lawyer Kim 
Swartz said.

"It's not over for us," he said. "We're continuing to closely monitor 
the results of these investigations and see what our options are."

As an administrative specialist, for which she drew a salary of $46,046 
in fiscal year 2006, Jackson provided "support to the Department of 
Nursing Administration, unit managers, clinical nurse specialists and 
staff," Moster wrote in an e-mail. She also developed internal systems 
to streamline communications and worked on programs, events and special 
projects.

Dr. David Feinberg, chief executive of the UCLA Hospital System, said 
Sunday that UCLA had reviewed the woman's UCLA phone records and e-mails 
and found no evidence that she leaked information outside the hospital. 
Without a subpoena or an employee's cooperation, however, UCLA would be 
unable to access an employee's personal telephone logs or banking 
records.

At the time, Feinberg said, the Westwood hospital did not believe that 
it was required to alert the patients whose records were viewed or to 
notify state health department or law enforcement authorities. Upon 
reconsideration, Moster said Tuesday, UCLA now plans to notify all of 
the affected patients by phone and mail that their records had been 
viewed improperly.

Feinberg has called Jackson, whom he did not identify, a "rogue" 
employee.

Jackson said she did not have insidious motives. "It was more of a 
curiosity," she said. "It was just me being nosy. If you see something 
or something happened the night before, you go in and you're like, 
'Maybe they were here.' You just kind of look. It wasn't to do anything 
to anybody. I don't even remember half the stuff I even looked at. There 
was no intent to do anything bad."

Asked why she looked at more than two dozen records of non-famous 
patients, she said, "it may have been me ordering some files for 
somebody."

In an e-mail sent to all UCLA health employees Monday, Feinberg and Dr. 
Thomas Sibert, president of UCLA Faculty Practice Group, wrote that 
officials now "can and do initiate electronic audits to track record 
access. . . ."

"Stories like the recent ones are clear reminders that we are all 
responsible to the commitment that we make to our patients every day -- 
the delivery of strong, compassionate care and protection of privacy."

Times staff writer Scott Glover and researcher John Tyrrell contributed 
to this report.

Copyright 2008 Los Angeles Times


___________________________________________________      
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn