Atascadero State Hospital reports data breach; employee accessed 2,000 COVID test results
A state employee improperly accessed more than 2,000 Atascadero State Hospital patient and employee records in a data breach identified in late February, Department of State Hospitals said.
The breach occurred when the DSH employee accessed names, COVID-19 test results, and health information necessary for tracking coronavirus for 1,415 ASH patients and former patients and 617 employees, a DSH news release said. The employee had access to ASH data servers through their information technology job duties.
The employee had been improperly accessing the information for about 10 months before DSH found out about the data breach, an FAQ about the incident said.
“It appears that the employee used the access they were provided in order to perform their normal job duties to go directly into the server, copy files containing patient, former patient, and employee names, COVID-19 test results, and related health information without any apparent connection to their job duties, indicating a high probability of unauthorized access,” the FAQ said.
DSH identified the breach on Feb. 25 as part of an annual review of employee access to data folders, the release said. The agency is investigating the improper access, and the employee is on administrative leave. It’s currently unclear why the employee accessed the information, the FAQ said.
The CHP is helping DSH with the data breach investigation. DSH has not found any evidence that the employee has made use of the information they accessed in the breach.
DSH is notifying patients, former patients and employees affected by the breach. The agency has reported the breach to the U.S. Department of Health and Human Services, the Office of Civil Rights, the California Office of Information Security, the California Office of Health Information Integrity, the California Highway Patrol, the California Department of Public Health, and the California Attorney General’s Office.
For more information on the breach, visit dsh.ca.gov/Breach_Notice.html.
This story was originally published March 18, 2021 at 12:52 PM.
