Meritus Medical Center, Inc.

Meritus Medical Center, Inc. (MD) reported to HHS OCR on 2015-06-26 an Unauthorized Access/Disclosure affecting 1,029 individuals. An audit revealed that a Walgreens pharmacy vendor employee accessed patient PHI in the electronic health record (EHR) without a business need. PHI exposed included names, dates of birth, medical record numbers, health insurance information, Medicare ID numbers, and clinical information. The CE terminated the employee's access, escorted them from campus, notified HHS, media, and affected individuals, offered credit monitoring, and implemented new technical controls limiting vendor EHR access. OCR obtained corrective action assurances.

Affected (this filing): 1,029