Today's New York Times reports:
An employee of NewYork-Presbyterian Hospital/Weill Cornell Medical Center in Manhattan stole information from the records of as many as 40,000 patients, a hospital spokeswoman said on Friday.The theft — which occurred over the past several years and included patients’ names, phone numbers and Social Security numbers — was discovered during a federal investigation, and the hospital was notified in January, the spokeswoman, Myrna Manners, said. An internal audit by the hospital confirmed the theft, she said.
Read the full article here.
Update 4/14/08: The Times is now reporting that the worker has been charged in federal court.
An employee of NewYork-Presbyterian Hospital/Weill Cornell Medical Center was charged on Saturday in federal court in Manhattan with stealing nearly 50,000 patient files and selling some of them, according to a criminal complaint.The worker, Dwight McPherson of the Bronx, was accused of stealing records as early as March 2006.
The rest of the Times story is here.
If McPherson is charged under HIPAA he would be only the third person I am aware of to face criminal charges. The first was Richard Gibson, a Seattle cancer center employee who in 2004 was sentenced to 16 months in prison for stealing one patients' protected health information. The other is Leslie Howell of Oklahoma City, a mental health counselor indicted in August 2007 for selling over one hundred patient files. If McPherson really did sell 50,000 patient files that would be the largest breach by far.