A hospital never turned off a former employee's login (2018) and what it shows about ending access at separation

A small hospital’s scheduling calendar kept working for someone who no longer worked there. The HHS Office for Civil Rights (OCR), which enforces HIPAA, announced a settlement in December 2018. It found that the hospital disclosed patients’ information to a former employee because it never deactivated that person’s username and password. The conduct took place in 2013. A 2017 OCR settlement describes the same gap at a larger health system, and a 2025 settlement adds a related case.

What happened

The hospital is small, with emergency care, a primary care clinic and other basic outpatient services. OCR opened a complaint investigation on June 7, 2013.

The complaint said a former employee still had remote access to the hospital’s web-based scheduling calendar after leaving the job. The calendar held patients’ electronic protected health information (ePHI), meaning health information kept in electronic form. According to the resolution agreement, the former employee received the information of at least 557 individuals on two dates, July 8 and September 10, 2013.

The agreement names a second problem. The hospital had also disclosed the same patients’ information to the calendar’s vendor without a business associate agreement. That is the written contract HIPAA requires before a vendor handles patient information. The hospital paid $111,400 and agreed to a two-year corrective action plan. The agreement states that it is not an admission of liability.

The cause stated in the record

The resolution agreement ties the disclosure to the former employee to one failure: the hospital did not deactivate the person’s username and password after employment ended. The login was to a web-based tool, and the complaint described the former employee’s access as remote.

In the announcement, OCR’s director said former staff “should immediately lose access” to patient information when they leave.

The corrective steps in the record

Most of the two-year plan targets the vendor problem and the hospital’s overall security process. The hospital agreed to the following:

• Revise its business associate policies. Named people would make sure every business associate signs an agreement before receiving patient information, and each vendor relationship would be assessed.
• Revise its policies on uses and disclosures of patient information. Staff would learn to spot improper disclosures, report them, and follow guidelines for downloading and using third-party services and apps.
• Complete a thorough risk analysis within 90 days, review it every year, and manage the risks it finds.
• Train its workforce on the revised policies, with password management among the topics.

The plan does not name a procedure for ending access when someone leaves.

Two other OCR settlements

In February 2017, OCR announced a $5.5 million settlement with a nonprofit health system over the same gap. From April 2011 to April 2012, someone used the login of a former employee at an affiliated physician’s office to reach patient information daily, and nobody noticed. That affected 80,000 individuals. OCR said the system had access policies but had not put in place procedures for reviewing, changing or ending users’ access. It also did not regularly review records of system activity, though its own risk analyses had flagged that risk from 2007 to 2012.

In May 2025, OCR announced an $800,000 settlement with a health system after a patient’s complaint in October 2018. An unknown person had contacted her with photographs of her printed medical records. OCR found that the login used to open her record belonged to a non-clinical former staff member of a physician’s practice. That practice could see the health system’s electronic records for shared patients. The release does not say when that person left. The potential failures OCR listed included not regularly reviewing records of system activity.

Controls usually expected after incidents like this

HIPAA’s Security Rule, at 45 CFR 164.308(a)(3), requires policies to make sure workforce members have appropriate access and that people without approved access can’t get it. Under that standard, termination procedures are listed at 164.308(a)(3)(ii)(C): procedures for ending access to ePHI “when the employment of, or other arrangement with, a workforce member ends.”

That item is marked “Addressable.” Under 164.306(d)(3), addressable doesn’t mean optional. You must assess whether the safeguard is reasonable and appropriate for you. If it is, you put it in place. If it isn’t, you write down why and put an equivalent measure in place if one is reasonable.

Two required items help you catch a login that was missed. Section 164.308(a)(1)(ii)(D) requires procedures to regularly review records of system activity, such as audit logs and access reports. Section 164.312(b) requires mechanisms that record and examine activity in systems holding ePHI. Unique user identification at 164.312(a)(2)(i) is also required: each user gets their own name or number, so those records show which person signed in.

For the full list of what to close when someone leaves, see which accounts to close when someone leaves a medical practice. The access control sections are explained in HIPAA Security Rule access control requirements.

Questions to ask about your own setup

</content>
</invoke>