We learned an employee accessed a customer's patient data without authorization
Investigate, document, revoke access, and determine if this is a reportable breach.
- 1
Suspend the employee's access immediately
While facts are gathered, ensure they cannot access more data. Preserve audit logs before they rotate or expire.
- 2
Interview and document
Find out what they viewed, how many patients were involved, and why. Document timestamps from system logs.
- 3
Notify your customer if required
Your BAA likely requires you to inform covered entity customers of unauthorized access. Your counsel can help with timing and wording.
- 4
Complete sanctions and retraining
Apply consistent disciplinary action and close gaps, such as stricter access reviews or alerts for unusual access patterns.
Important
Unauthorized insider access is a frequent source of OCR enforcement against vendors and health systems.
Related
Still unsure? Ask AI about this situation →
Not legal advice. Follow your organization's policies and consult counsel for legal questions.