Doctor alleges second person also changed patients' records in WDH privacy breach-NH

Doctor alleges second person also changed patients' records in WDH privacy breach

By Adam D. Krauss
akrauss@fosters.com
Wednesday, December 23, 2009
DOVER — A doctor impacted by the privacy breach at Wentworth-Douglass Hospital says a second employee improperly accessed and changed patients' records but never lost her job. (If they look a little deeper, I'm sure they'll find this isn't the only hospital in NH where patients records have been accessed and changed.)

"There was another woman that's still working at the hospital," said Dr. Cheryl Moore, whose Piscataqua Pathology Associates group was contracted to run pathology lab at WDH. "She did the same thing as the first lady, but to a lesser degree."

Unlike the woman who lost her job, this employee escaped punishment because Gint Taoras, the lab director and a WDH employee, and Dalma Winkler, the hospital's privacy officer, halted a full audit of what she had done, Moore claims.

"They reviewed a few cases just to see they were ... looking at similar records," Moore said Tuesday, but the hospital didn't review more cases "because they didn't want to know that they had more trouble."

Moore and her partner, Dr. Glenn Littell, have said WDH administration resisted investigating the breach and retaliated against them by not renewing their contract after they pushed for disclosure — allegations rebuffed by WDH CEO and President Gregory Walker.

Moore's comments came after Foster's Daily Democrat received a community commentary written by her husband, Dr. Thomas Moore, a surgeon with courtesy privileges at WDH.

In the commentary, published in today's edition, he says "had the Hospital's administrators had their way, an investigation into this breach would never have taken place. This is highlighted by the fact that the person who committed this heinous act had an accomplice who was never investigated and never fired. This was a determination made by the Hospital."

WDH spokeswoman Noreen Biehl confirmed Tuesday only one person lost their job as a result of the breach but didn't immediately respond to the allegation of an "accomplice" or whether another employee was involved in some way.

The doctors have said the ex-employee altered records of some 1,100 patients after being transferred out of the lab, where she had worked for many years, after she was cited for poor performance. This second employee, Cheryl Moore said, "was friends with" the ex-employee "and she got transferred out around the same time."

In another development, a state investigator says he's reviewing information he didn't have when he determined Wentworth-Douglass Hospital didn't have to notify patients whose records were improperly viewed or altered in a 13-month privacy breach, which involved about 1,800 unauthorized patient record views from May 2006 to June 2007.

James Boffetti, who leads the Office of the Attorney General's consumer protection and antitrust bureau, said he's received images of computer screens that were viewed by the rogue employee — images an attorney for Moore and Littell says shows patients' Social Security numbers and sensitive insurance policy data were compromised.

"I will certainly review everything," said Boffetti, stressing that doesn't mean he's necessarily reopening his case file. "I want to have a chance to look at it more carefully."

Boffetti would not say if he would have liked to have the images at the time of his initial review.

Late last week, Charles Grau, a Concord attorney representing Moore and Littell, said the images could "significantly change" Boffetti's view of whether the breach impacted patients' personal information as defined by RSA 359-C: 19.

Boffetti had determined the breach did not meet the law and therefore the hospital did not need to notify the state or patients.

Boffetti said he never sought the images and he's "not alleging" the hospital withheld information. "The hospital has been cooperative," he said.

Biehl questioned why the pathologists didn't provide the state with the images when they reported the matter to several agencies.

"We were never interviewed," Grau said, noting he provided the information to Boffetti upon learning a decision was made after reading about in Foster's Daily Democrat.

Boffetti relied on an audit summary that was completed in May in carrying out his initial review. From that he knew patients' first names were changed, something state law says constitutes personal information. He would not explain Tuesday how such a change didn't fit the law's requirement.

Biehl said she is still waiting for a report from state health investigators who reviewed hospital and pathology lab operations at the direction of the federal Centers for Medicare and Medicaid Services. The College of American Pathologists is also investigating.

Moore and Littell, whose group is running the lab until March, also brought the case to the Office of Civil Rights of the U.S. Department of Health and Human Services, which enforces privacy laws, and DHHS' Office of Inspector General.

The Joint Commission, which accredits health care organizations, has determined the hospital satisfactorily addressed the situation.


http://www.fosters.com/apps/pbcs.dll/article?AID=/20091223/GJNEWS_01/712239922/-1/rss3&source=RSS