Private medical records of 3,472 patients at two ProMedica hospitals in Michigan were inappropriately breached by seven employees, Julie Yaroch, the health system’s president at both hospitals, told The Blade on Friday night.

The patients’ names, birth dates, medications, and clinical information from acute care services were accessed at ProMedica Bixby Hospital in Adrian and Herrick Hospital in Tecumseh by the employees, three of whom have been terminated because they had no reason to access the records. 

The remaining four, whose jobs gave them authority under certain circumstances to access the records, are getting “extensive disciplinary action,” Ms. Yaroch said.

Ms. Yaroch added that the hospitals have no reason to believe the information was retained for outside use.

The hospitals can prove that none of the records was printed, Ms. Yaroch said.

“This was a very serious event,” she said, adding that the data breach also is being investigated by the U.S. Department of Health and Human Services.

The breach was brought to the attention of hospital administrators by another ProMedica employee in April.

The patients, who were notified of the breach by letter on Tuesday, have been offered identity protection for one year on behalf of ProMedica.

The probe lasted several months because of “the extent of the investigation,” and was slowed by a lack of necessary software, Ms. Yaroch said.

The breach at Bixby and Herrick hospitals comes two years after a former ProMedica Bay Park Hospital employee was caught accessing the private information of nearly 600 patients.

Former ProMedica respiratory therapist Jamie Knapp, 25, of Adrian was indicted in U.S. District Court in April, 2015, on two charges, one of which was later dismissed by Judge Jeffrey Helmick. 

The judge dismissed a charge of unauthorized use of a protected computer while keeping a charge of obtaining individually identifiable health information. The information was gathered between May, 2013, and March, 2014.

Ms. Yaroch said that ProMedica aims to improve its protection of patient information, crediting the employee who notified them of the breach for the help.

“Because of that, we were able to put additional policy in place to assure the privacy in our community,” she said.

She didn’t elaborate on what those additional policies entail.

So far, none of the patients have requested further legal action against the health system.

Contact Elena Saavedra Buckley at: ebuckley@theblade.com, 419-724-6050, or on Twitter at @elenaSB_.

First Published June 4, 2016, 4:58 a.m.