From: InfoSec News (alertsinfosecnews.org)
Date: Wed Apr 09 2008 - 03:10:52 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

http://www.latimes.com/news/printedition/california/la-me-ucla9apr09,1,925908.story

By Charles Ornstein
Los Angeles Times
Staff Writer
April 9, 2008

The UCLA Medical Center employee who allegedly pried into the private
medical records of the governor's wife and 60 others in a burgeoning
scandal was a low-ranking administrative specialist who told The Times
on Tuesday that "it was just me being nosy."

"Clearly I made a mistake; let's put it like that," Lawanda J. Jackson,
49, said when asked in a telephone interview why she improperly looked
at the records of so many patients, including California First Lady
Maria Shriver and actress Farrah Fawcett.

"I didn't leak anything or anything like that," said Jackson, who had
worked at the hospital since she was 16. "It wasn't for money or
anything. It was just looking."

UCLA took steps last May to fire Jackson after determining that she had
inappropriately accessed dozens of electronic medical records, UCLA
officials say. But the employee resigned in July before she could be
fired, spokeswoman Roxanne Moster said. (Previously, the hospital told
The Times that it had fired Jackson.)

Neither UCLA nor state health officials have confirmed Jackson's
identity, but The Times was able to verify it.

The breaches have triggered several state investigations and created a
major embarrassment for UCLA. The hospital could face serious sanctions
from the California Department of Public Health, and Jackson could face
criminal charges for allegedly violating a federal privacy law.

Although such charges are uncommon, federal prosecutors in Los Angeles
have launched a preliminary inquiry into the matter, a source in the
U.S. attorney's office said Tuesday.

"We're certainly interested and we're looking into it," said the source,
who asked not to be named because he was not authorized to speak
publicly about the case.

Among the 61 patients whose records Jackson allegedly viewed in 2006 and
2007 were 33 celebrities, politicians and other well-known people, state
officials have said.

UCLA's ability to keep patients' information private has been at issue
since The Times reported last month that the university was trying to
fire 13 workers and was disciplining 12 others for peeking into the
records of pop star Britney Spears, who was hospitalized in its
neuropsychiatric unit in January.

Lawyers for Fawcett contend that UCLA employees might have leaked or
sold information on the recurrence of the actress' cancer last May to
the tabloids, including the National Enquirer. The Enquirer published
several sensational stories soon after her visits to the medical center,
the lawyers said, including a piece titled "Farrah's Cancer Is Back!"
before Fawcett was able to tell her son about it.

Through UCLA, the lawyers asked for a meeting with Jackson last year,
but she declined. (Fawcett's lawyers did not know Jackson's name at the
time but wrote to her as "Jane Doe.")

In the interview with The Times, Jackson would not say whether she had
ever spoken to the Enquirer. "I'm not going to answer that," she said.
"I'm scared to answer that. . . . I know I'm not the leak. I don't
believe I'm the leak."

She dismissed questions about whether she had a financial motive to sell
information. According to court records, Jackson and her husband,
Victor, filed for bankruptcy protection in 2001, listing assets of less
than $23,000 and liabilities of $37,300. But she said, "that was a long,
long, long time ago." In the 2001 filing, she listed her job at UCLA;
her husband said he was disabled.

Fawcett's lawyer said UCLA officials notified him of Jackson's name
Monday evening after The Times made inquiries to the medical center
about employees named Jackson.

"We had been asking for the name for nine months and they refused to
give it to us and last night at 6 p.m. they gave it to us," lawyer Kim
Swartz said.

"It's not over for us," he said. "We're continuing to closely monitor
the results of these investigations and see what our options are."

As an administrative specialist, for which she drew a salary of $46,046
in fiscal year 2006, Jackson provided "support to the Department of
Nursing Administration, unit managers, clinical nurse specialists and
staff," Moster wrote in an e-mail. She also developed internal systems
to streamline communications and worked on programs, events and special
projects.

Dr. David Feinberg, chief executive of the UCLA Hospital System, said
Sunday that UCLA had reviewed the woman's UCLA phone records and e-mails
and found no evidence that she leaked information outside the hospital.
Without a subpoena or an employee's cooperation, however, UCLA would be
unable to access an employee's personal telephone logs or banking
records.

At the time, Feinberg said, the Westwood hospital did not believe that
it was required to alert the patients whose records were viewed or to
notify state health department or law enforcement authorities. Upon
reconsideration, Moster said Tuesday, UCLA now plans to notify all of
the affected patients by phone and mail that their records had been
viewed improperly.

Feinberg has called Jackson, whom he did not identify, a "rogue"
employee.

Jackson said she did not have insidious motives. "It was more of a
curiosity," she said. "It was just me being nosy. If you see something
or something happened the night before, you go in and you're like,
'Maybe they were here.' You just kind of look. It wasn't to do anything
to anybody. I don't even remember half the stuff I even looked at. There
was no intent to do anything bad."

Asked why she looked at more than two dozen records of non-famous
patients, she said, "it may have been me ordering some files for
somebody."

In an e-mail sent to all UCLA health employees Monday, Feinberg and Dr.
Thomas Sibert, president of UCLA Faculty Practice Group, wrote that
officials now "can and do initiate electronic audits to track record
access. . . ."

"Stories like the recent ones are clear reminders that we are all
responsible to the commitment that we make to our patients every day --
the delivery of strong, compassionate care and protection of privacy."

Times staff writer Scott Glover and researcher John Tyrrell contributed
to this report.

Copyright 2008 Los Angeles Times

___________________________________________________
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]