Observations
Based on a complaint investigation conducted on May 14-15, 2024, the facility failed to ensure the confidentiality of client electronic records.
A former facility employee, who has not worked at the facility since 2023, continued to have access to the facility's account at Atlantic Diagnostic Laboratories LLC. The facility forgot to have the lab deactivate the former employee's account access.
The former employee continued to access client information through May 2024, which she then disseminated in an unsecure email dated May 1, 2024, to this Department, other agencies, and individuals. Client identifying information including full client names, birthdates, social security numbers, and their urine drug screen test results were included in the email to multiple agencies and individuals for which client consent was not obtained and who should not have access to the information.
|
Plan of Correction
All staff , including contracted staff, will be retrained by the Program Director on the requirements of PA State code § 709.28. Confidentiality (b) , that the project shall secure hard copy client records within locked storage containers; Electronic records must be stored on secure, password protected data bases. Staff training will be completed by 6/30/2024.
Effective immediately, Interim House Program Director will notify internal and external database administrators whenever a staff member who has access to electronic client records is terminated from employment at Interim House West within 3 days of termination. Database administrators include: PHMC I.T. (215-985-2599), Atlantic Diagnostic Laboratories LLC (267-525-2470), and any other client-specific database record resources (see client files).
|