Hospital Employee’s Facebook Post Results in Identity Theft for Patient

Christina Thielst, Host of Christina's Considerations
Christina Thielst, Host of Christina's Considerations

By Christina Beach Thielst

First Posted at Christina’s Considerations on 10/22/2013

Christina Thielst, Host of Christina's Considerations
Christina Thielst, Host of Christina’s Considerations

A hospital employee took a simple picture in his/her Emergency Department workspace for a Facebook post.  However, the picture also captured his/her computer screen and a patient’s personal information.

This simple data breach and HIPAA violation unfortunately has already lead to the patient’s identity being used by someone who now has her name, address and social security number. The patient describes this entire incident as a “nightmare”, so my guess is that her patient satisfaction scores for the visit will reflect the fear and frustration she is experiencing.

This report initially ran in the local newspaper and, I’m guessing, has created a bit of a public relations mess for the University of Arizona Medical Center, as well.

So lets review the costs to the hospital:

1. HIPAA penalities

2. Potential state fines

3. Lawsuit: Defense costs and settlement/award

4. Damage to brand and recovery costs

5. Additional training costs and potential recruitment costs (to fill a possible vacancy if the employee is terminated)

6. Lower patient satisfaction score and reduction in reimbursement

Hummm, wonder if the employee feels this was all worth a picture that was ultimately removed from his/her Facebook page.


  1. Yeah. If it were my personal data that was stolen in this way I’d be suing the hospital for literally millions, and I’d pressing the police to arrest the employee. This criminal negligence needs to result in actual prison time for the employee in question, and possibly his/her supervisor. He/she should never work in health care in any capacity ever again.

    For all the hoopla made about Rx drug abuse and the like, the REAL crimes in health care–the ones that result in the most serious diminishing of quality of life—are things like this.

  2. I don’t understand how a photograph of an ER includes patient confidential information. Please clarify. Thank you for your assistance.

    • It was a photograph of her workstation and the picture captured her monitor’s screen — with the patient’s information clearly visible. Some might say an accident, but was it worth the risk?

  3. I started a sentence with “who the he** would take a photo with a live computer screen in it??” But I didn’t get past the first three words before I realized that it was completely rhetorical. Why think through an action when I can just do it? Think about the repercussions? What’s that?