Holy Cross Hospital, Inc.

An employee of Holy Cross Hospital, Inc. accessed and used protected health information (PHI) outside of their job duties to file fraudulent tax returns. The breach, reported to HHS on September 24, 2013, affected 9,900 individuals and compromised names, addresses, and Social Security numbers. The information was located on a desktop computer and network server. In response, the hospital terminated the employee, retrained staff, and enhanced its risk management procedures.

Holy Cross Hospital (FL) reported to HHS OCR on 2010-11-16 a Theft/insider incident affecting 1,500 individuals (notification sent to ~44,000 potentially affected). A hospital employee impermissibly copied patient data sheets containing PHI — including names, addresses, dates of birth, SSNs, insurance information, and diagnoses — and sold the information to a third party. Confirmed PHI of 38 individuals was sold; ~1,500 were initially identified as at risk. The CE cooperated with federal and state authorities, offered free credit monitoring, and implemented extensive corrective actions under OCR oversight.