Ann and Robert Lurie Children's Hospital of Chicago reported that an employee viewed more than 4,800 patient medical records without a work-related reason, according to a notice posted May 4 on its website.
The hospital discovered the employee inappropriately accessed medical records between Nov. 1, 2018, and Feb. 29, 2020. The privacy breach may have affected 4,824 patients, according to HHS' Office for Civil Rights data breach portal.
Lurie Children's terminated the employee's access to its information systems on March 5 after discovering the security incident and launched an investigation.
The statement says the hospital "addressed the issue in accordance with our disciplinary policies, and the employee no longer works for the Hospital."
The hospital found that patient information exposed included names, addresses, dates of birth and medical information such as diagnoses and medications. The employee did not have access to full Social Security numbers, insurance information or financial account information.
The hospital said it does not suspect that any exposed patient information was misused or publicly released.
Since the incident, Lurie Children's has retrained staff on appropriate access to patient records and enhanced monitoring capabilities.