Harris Health discloses insider-wrongdoing breach that went on for a decade

Harris Health disclosed an insider wrongdoing breach that persisted for a decade, with more than 5,000 patients notified after the system identified the issue. The employee responsible was fired and referred to law enforcement when the wrongdoing came to light, and the case has been described as access to patient records without a legitimate purpose and sharing the information outside the health system.

The misconduct occurred from 4 January 2011 to 8 March 2021, and disclosure was delayed because of a law enforcement hold on the investigation, according to CW39. Harris Health posted a substitute notice on its website, which states the breach was discovered on 10 February 2021 but does not explain how it was discovered; notification began once law enforcement cleared the system to proceed.

The breach included demographic, clinical, and insurance information, and for a limited number of patients may have included Social Security numbers; the employee was not named in the notice, and there is no detail on any criminal case against them. According to Harris Health, the exact patients affected could not be determined.