Community Hospital of San Bernardino fined for data breach

[Jake Kouns <jkouns () opensecurityfoundation org>]

http://www.sbsun.com/news/ci_15296727

For violations of patient confidentiality, the state Department of
Public Health fined Community Hospital of San Bernardino $325,000.
The hospital was assessed a $250,000 fine for unauthorized access of
204 patients' medical information by one employee.

A fine of $75,000 was added after the facility failed to prevent the
unauthorized access of three patients' medical information in a
separate case.

Diane E. Nitta, the hospital's administrator, said the hospital has
"enhanced staff education efforts around patient privacy (and) put in
place expensive security measures that guard against inappropriate
access to our patients' records."

Disciplinary action was taken against the two employees involved, she
said, adding that the hospital reported the privacy breaches to the
state.

Hospital spokeswoman Tobey Robertson said none of the information was
used to harm the patients.

In the case of the larger fine, a radiology technician accessed 204
patient's computerized medical records without a clinical need for the
information.

In the smaller fine, a clerk let a friend enter a restricted area,
where the person heard confidential patient information given by three
patients during the admitting process.

Community Hospital will not contest the fines, Robertson said.

The hospital was one of five fined by the Department of Public Health.
_______________________________________________
Dataloss-discuss Mailing List (dataloss-discuss () datalossdb org)
Archived at http://seclists.org/dataloss/

Get business, compliance, IT and security staff on the same page with
CREDANT Technologies: The Shortcut Guide to Understanding Data Protection
from Four Critical Perspectives. The eBook begins with considerations
important to executives and business leaders.
http://www.credant.com/campaigns/ebook-chpt-one-web.php