It appears that the Catskill Regional Medical Center in Harris, New York takes the HIPAA requirements seriously and obviously has put some controls in place to catch employees who are looking through patient files when they have no job need to do so.

"CRMC employee fired for unauthorized access to patient files"

The employee was fired for looking through 431 files of patients who she knew or worked with.

Some good security practices were likely in place to be able to catch this employee:

• The employee was caught as a result of an audit. This means that there were access logs of some type(s) in place to document whenever someone accessed patient files. Does your organization log whenever someone accesses the personally identifiable information (PII) within your enterprise?
• The snooped-upon patients were notified. This is not only a good breach response practice, it is also required by at least 46 U.S. breach notice laws.
• The hospital actively enforced the sanctions for non-compliance with their own internal policies as well as with federal laws. Does your organization consistently enforce sanctions for policy and law non-compliance?

• The hospital likely had ongoing awareness communications and regular training in place to be able to fire the employee. Do you have effective training, such as this and this, and ongoing awareness communications, such as this, in place?

This is also a good example of the insider threat. In this case, according to the report, it sounds like the motivation for the person to snoop was merely curiosity...she had access so she took advantage of that access even though she had no business need to look at the records.

Wonder how many of the physical, hard copy records she snooped through, too? It's harder to log access to papers as opposed to digital files.