Easy Question, Complicated Answer: What Does It Take to Stop Workers From Snooping?

Insider threats remain a worrying concern in health data breaches, with snooping often driven by curiosity or, at times, more malicious motives. According to Report on Patient Privacy, Theresa Defino discusses a presentation by UHealth, the University of Miami Health System, that highlighted challenges in sharing details about a significant incident and the value of transparency.

The piece quotes Tuya emphasising that the Privacy Rule protects patients’ confidentiality and that addressing employee snooping matters because of serious consequences for both staff and organisations. It notes common scenarios such as staff using their work credentials to access a child’s record or a spouse checking an appointment, rather than using an authorised patient portal. It observes that many institutions categorise all personal access as inappropriate, though discipline can be inconsistent across cases.

The article also discusses crafting zero- or low-tolerance policies with termination language, while noting that not every violation under UHealth’s policy results in termination, depending on the individual’s motivation and understanding of the policy.