As we told you in our June 2 edition (Noted, "Hospital records breached?"), Memorial Health System has been investigating the unauthorized accessing of some 2,500 patient records.
Today, the city-owned health system issued a statement about the problem:
Memorial Patient Records Improperly Accessed
Memorial Health System recently discovered that a former city of Colorado Springs employee, Lori Niell, allegedly accessed approximately 2,500 Memorial patient records without a medical, billing or operational reason. Niell, as a nurse in the city’s Occupational Health Clinic, was authorized to have access to Memorial’s encrypted patient records as part of her job,
but she allegedly accessed patient records for personal reasons. It does not appear Niell used the records for identity theft.
Memorial first learned of the incident May 20 when notified by the city of Colorado Springs, and Memorial immediately launched an investigation. Although Niell was not a Memorial employee, Memorial reported Niell to the police and has been fully cooperating with their efforts. Memorial is also working to create even greater additional safeguards in its electronic medical records.
“We are both saddened and angered by this incident,” said Memorial Chief Executive Officer Dr. Larry McEvoy. “People entrust us with their lives and most intimate details. They turn to us for safety, privacy and respect, and that’s a special trust we take seriously.”
Niell was an authorized user on Physician Link, which is an encrypted, password-protected electronic-records system designed to allow community health providers access to their patients’ information related to care at Memorial. All such users are required to sign forms agreeing to follow federal health care privacy laws, and a list of users is maintained and updated by Memorial.
Memorial has formed a task force that’s working to bolster security to prevent these sorts of cases, as well as exploring software systems that will allow Memorial to detect unusual medical record activity more quickly. Protecting patient privacy is a challenge all health systems face as the exchange of information becomes increasingly paperless, and Memorial takes this challenge seriously.
Affected patients are being notified of the incident by mail, and Memorial has been in contact with the Office of Civil Rights, the federal agency responsible for investigating patient privacy complaints.
Niell is no longer employed by the city, according to city spokesperson John Leavitt.
We've asked the police department to explain the status of any criminal investigation involving Niell but haven't heard back.