Skip to main content
 HHS.gov
 Search
 U.S. Department of Health & Human Services
  Search Close
 A-Z Index
 About HHS
Programs & Services
Grants & Contracts
Laws & Regulations
 Home > About > News > City Health Department failed to terminate former employee’s access to protected health information
 Text Resize  
                                A
                                A
                                A
                            Print
                            Share
 Search News Releases
View 2016 - 1991 archive
 FOR IMMEDIATE RELEASEOctober 30, 2020Contact: HHS Press Office202-690-6343[email protected]City Health Department failed to terminate former employee’s access to protected health informationThe City of New Haven, Connecticut (New Haven) has agreed to pay $202,400 to the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) and to implement a corrective action plan to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules.  The New Haven Health Department, among other things, operates a public health clinic that provides preventative medical services, including adult and pediatric immunizations.
In January 2017, the New Haven Health Department filed a breach report with OCR stating that a former employee may have accessed a file on a New Haven computer containing the protected health information (PHI) of 498 individuals. OCR’s investigation revealed that, on July 27, 2016, a former employee returned to the health department, eight days after being terminated, logged into her old computer with her still-active user name and password, and downloaded PHI that included patient names, addresses, dates of birth, race/ethnicity, gender, and sexually transmitted disease test results onto a USB drive. Additionally, OCR found that the former employee had shared her user ID and password with an intern, who continued to use these login credentials to access PHI on New Haven’s network after the employee was terminated.
OCR’s investigation determined that New Haven failed to conduct an enterprise-wide risk analysis, and failed to implement termination procedures, access controls such as unique user identification, and HIPAA Privacy Rule policies and procedures.
“Medical providers need to know who in their organization can access patient data at all times. When someone’s employment ends, so must their access to patient records,” said OCR Director Roger Severino.
In addition to the monetary settlement, New Haven has agreed to a robust corrective action plan that includes two years of monitoring. The resolution agreement and corrective action plan may be found here*.
*People using assistive technology may not be able to fully access information in this file. For assistance, contact the HHS Office for Civil Rights at (800) 368-1019, TDD toll-free: (800) 537-7697, or by emailing [email protected].###Note: All HHS press releases, fact sheets and other news materials are available at https://www.hhs.gov/news.Like HHS on Facebook, follow HHS on Twitter @HHSgov, and sign up for HHS Email Updates.Last revised: October 30, 2020 Sign Up for News Release UpdatesEnter your email:
Email Subscribe to RSSReceive latest updates Related News ReleasesOCR Settles Thirteenth Investigation in HIPAA Right of Access Initiative
  OCR Issues Guidance on HIPAA, Health Information Exchanges, and Disclosures of Protected Health Information for Public Health Purposes
  OCR Issues Audit Report on Health Care Industry Compliance with the HIPAA Rules Related Blog PostsHHS Blog thumbnail  
  Spotlight on Naloxone Co-Prescribing
          HHS Blog thumbnail  
  Now is the time: Catch-up to Get Ahead on Childhood Immunizations
          HHS Blog thumbnail  
  Health Providers: Join the Telehealth Revolution
 Public Affairs Contacts
HHS Media InformationASPA Press ContactsHHS Agency Press Contacts
**View all**
 Connect With Us
 Sign Up for Email Updates To sign up for updates or to access your subscriber preferences, please enter your contact information below. Email
 HHS Headquarters U.S. Department of Health & Human Services
						200 Independence Avenue, S.W.
						Washington, D.C. 20201
						Toll Free Call Center: 1-877-696-6775​
 Contact HHS
                        Careers
                        HHS FAQs
                        Nondiscrimination Notice
 HHS Archive
                        Accessibility
                        Privacy Policy
                        Viewers & Players
 Budget/Performance
                        Guidance Portal 
                        Inspector General
                        EEO/No Fear Act
 FOIA
                        The White House
                        USA.gov


Back to *T*op