Eastern Idaho Public Health reports insider data breach involving unauthorized access to medical records

Eastern Idaho Public Health (EIPH), a regional public health agency that serves several counties in eastern Idaho, has confirmed the discovery of an insider data breach involving one of its former employees who accessed patient medical records without authorization. The breach was identified following a review of employee access logs and interviews conducted with staff members after suspicions of unauthorized access were raised.

The employee, whose access to medical records was later found to include patient clinic notes, viewed sensitive information such as health screening details, patient histories, assessments, medical orders, and test results. However, Eastern Idaho Public Health has assured patients that no copies of the records were made, and the organization is confident that the accessed information has not been used for malicious purposes. There are no indications suggesting that the patient data will be misused in the future.

The organization has taken immediate action, terminating the employee involved and reinforcing training among staff members on appropriate medical record access as per the Health Insurance Portability and Accountability Act (HIPAA). The breach has not yet been listed on the Office for Civil Rights breach portal, and it remains unclear how many patients may have been affected by the incident.

In a related matter, both Pacific Pulmonary Medical Group and Ingham County Medical Care Facility (Dobie Road) have also reported separate incidents involving unauthorized access to sensitive data. Pacific Pulmonary Medical Group identified an unauthorized intrusion into its scheduling software, while Ingham County Medical Care Facility revealed that patient data had been accessed through a security incident at its electronic health records portal manager.