Deschutes County District Attorney John Hummel launched a criminal investigation Friday into the caregiver at St. Charles Health System who inappropriately viewed the electronic medical records of nearly 2,500 patients out of curiosity.

Hummel said an alleged breach of that magnitude should have been reported to local police so a proper criminal investigation could be conducted.

St. Charles launched its own investigation in January. The hospital found between Oct. 8, 2014, and Jan. 16, the caregiver may have reviewed as many as 2,459 files containing patients’ names, addresses, dates of birth, health insurance information, driver’s license numbers, diagnoses, physicians’ names, medications and treatment information.

Lisa Goodman, St. Charles spokeswoman, said the hospital properly followed federal and state notification process for a privacy violation. The hospital notified the affected patients, the Secretary of the Department of Health and Human Services and the state attorney general.

Hummel had not yet contacted the hospital directly as of Friday afternoon, according to Goodman.

“We have no indication that the caregiver involved is intending to use our patients’ information to commit a crime,” Goodman said. “Nevertheless, we’ve offered affected patients the option of credit monitoring and identity restoration services because we think it is the right thing to do.”

Hospital officials say the caregiver signed an affidavit stating she did not use or share the confidential information to commit fraud or financial crimes.

“The caregiver who was involved has actually been cooperative in this investigation and has signed an affidavit,” Nicole Hough, St. Charles corporate compliance officer, said Thursday. “Any of the confidential information she viewed was not to commit fraud.”

Citing their policy on personnel matters, officials declined to name the employee, her specific job or what disciplinary action resulted from the incident. Officials said the woman provided patient care as a clinical care provider, and was disciplined “swiftly and appropriately.”

Hummel plans to work with local law enforcement to ensure all relevant facts are detected. He will then conduct a legal analysis to determine if any criminal laws were violated.

When the investigation concludes, Hummel will announce his findings. If necessary, criminal charges will be filed.

St. Charles sent letters Thursday to affected patients. No phone calls will be made.

Goodman said a patient reported receiving a scam call from someone claiming to be from St. Charles and offering to help protect her health information.

“If anyone gets a phone call from anyone claiming to be from St. Charles, they should not talk to those people,” Goodman said. “All the information we are providing will be in the letter.”

— Reporter: 541-617-7820, 
kspurr@bendbulletin.com