The article below, discusses a $2.15 million Civil Money Penalty against Jackson Health System regarding noncompliance that lead to 24,188 patients’ records being inappropriately accessed and sold by one of the employees since 2011. JHS paid the full penalty amount due to the Office for Civil Rights.
A portion of the article states “On August 22, 2013, JHS submitted a Breach Notification Report (Report) to OCR that indicated a loss of paper records from its Health Information Management department that affected 756 patients and that occurred in January 2013 (January 2013 Loss). JHS’s internal investigation revealed that additional patient records were lost, but it was not until June 2016 that JHS reported the additional losses, and the increased number of impacted individuals grew from 756 to 1,463.”
1) Why do YOU THINK JHS delayed reporting the additional losses?
2) Why did it take JHS 5 years to realize an employee was selling patient information?
3)What can JHS do to prevent similar events from occurring in the future?