Privacy & Cybersecurity Law Blog

The Attorney General of Connecticut, Richard Blumenthal, is investigating an alleged breach of medical records at Griffin Hospital in Derby, Connecticut.  The hospital believes that a formerly affiliated radiologist gained unauthorized access to its digital Picture Archiving and Communications System (“PACS”), which stores patient information, including names, exam descriptions and medical record numbers.  In February, the hospital began receiving inquiries from patients who had been contacted by the radiologist to promote professional services offered at another medical facility.  In response to patient inquiries, the hospital conducted an internal investigation that revealed several instances of unauthorized access to the PACS system.  The hospital subsequently notified Attorney General Blumenthal.

In a statement, the Attorney General indicated that “unauthorized accessing of patient information is a violation of the federal HIPAA law that my office is empowered to enforce” and that he would “seek strong and significant sanctions, if warranted by the facts.”

Passed as part of the economic stimulus legislation in 2009, the HITECH Act authorizes state attorneys general to enforce HIPAA.  Attorney General Blumenthal was the first state attorney general to file a suit pursuant to this HITECH Act enforcement authority.  For more information on the first HITECH Act suit, please see our previous blog post.