Jackson Memorial Hospital advertises itself as ranked among “America’s Best Hospitals” by U.S. News & World Report.

I wonder if the insider breach reported in the Sun Sentinel might change that status.

Ruben E. Rodriguez allegedly paid JMH ultrasound technician Rebecca Garcia $1,000 a month for the hospital records of hundreds of patients treated for slip-and-fall accidents, car-crash injuries, gunshot wounds and stabbings, federal authorities said.

Rodriguez then brokered the patients’ names, addresses, telephone numbers and medical diagnoses to the lawyer, according to an indictment.

The story supports several of my predictions in the “Top 10 Security Breaches” presentations. Note, for example, the theft occurred for several years without detection by even simple security measures.

The story goes that a business proposition was made in 2006 by Rodriguez. Garcia agreed in 2007 and started to access patient records outside her department or that had not been treated by her. Easy to detect? Absolutely. When I ran computer security for a radiology department around the time HIPAA was being ratified the Ultrasound systems were very distinct from even other radiology procedures and processes, let alone treatments outside the department. The more different a care center operates, the easier to distinguish user behavior on the network. It might seem impossible to tighten controls around role based access until you take a high-level view of the business and realize that everyone already sees differences between themselves and the other teams, shifts, departments, etc..

Was this a HIPAA violation? I’m not a lawyer, but…fortunately in 2009 Garcia had a change of heart and contacted authorities herself.

My question is still whether the type and frequency of incidents will be incorporated into future ratings of hospitals in America.