Minneapolis-based Allina Health said a former employee impermissibly accessed the records of 715 patients in its EHR.
The health system said it was alerted to the concern about the ex-staffer in January before determining in March the person had "inappropriately accessed certain health information of some patients," such as diagnoses and treatment information, as well as personal details like names, addresses and the last four digits of Social Security numbers, according to the May notice. Credit card numbers and banking information were not breached, the health system said.
"We recently implemented a more robust access monitoring system to audit employees' access to the electronic medical record, and we continue to evaluate opportunities to enhance this system," Allina Health said in a statement.
The person last worked for Allina Health in 2022, according to the health system. Allina Health said it notified the patients involved but declined to say whether it was taking legal action against the former staffer.