In October 2020, Mayo Clinic reported that a former employee was found to have committed impermissible access to the health records of roughly 1,600 patients. Based on a statement released by the Mayo Clinic, the ex-employee looked at demographic data, birth date, clinical notes, medical record number, and in a number of instances images. As per Mayo Clinic, the investigation revealed no proof that suggests any patient information was duplicated or retained. All impacted patients had been informed regarding the breach via mail.
The worker involved in the case was 28-year-old Ahmad Maher Abdel-Munim Alsughayer from Saginaw, MI, who was a physician at Mayo Clinic. Alsughayer stopped working with Mayo Clinic in August 2020, when the privacy violation was uncovered.
The Attorney’s Office of Olmsted County now opened a criminal case against Alsughayer for gross misdemeanor unauthorized computer access. On July 8, 2021, he will appear in court. The criminal case is a result of allegations that Alsughayer misused his access rights to health records, viewing them when there’s no requirement to do so to carry out his job as a physician and hospital staff. Alsughayer’s legal team submitted a motion to dismiss the case on June 1, 2021 on the argument that there’s no probable cause to consider the defendant had done the offense(s) charged in it.
Alsughayer already faced three allegations in the past, the most recent of which was a May 29, 2021 lawsuit submitted against Alsughayer and Mayo Clinic. In December 2020, a woman patient, known as K.M.M in the suit, got in touch with Rochester police after getting Mayo Clinic’s breach notification letter.
She had discovered that a hospital worker accessed her health records, which contained nude pictures taken on 3 different occasions. After asking to access her health records, the woman found out the dates of impermissible access had the same dates when the pictures were taken. She claimed the hospital staff concerned in the breach notification letter viewed her health records particularly to look at her nude pictures.
As per the lawsuit, the physician was not on-campus and was on a private site when her health records were viewed and Alsughayer didn’t need photographic pictures of the plaintiff’s genitals and breasts to carry out his work. A court hearing is booked in August.
Besides that lawsuit, there were two class-action lawsuits submitted in Olmsted County Court that were linked to the breach. The plaintiffs in one lawsuit versus Alsughayer and Mayo Clinic are Chelsea Turner (MN) and Amanda Bloxton-Kippola (MI). The plaintiff in the second legal case is Olga Ryabchuk (MN) with Mayo Clinic and John Doe as defendants. One of the lawsuits claims that the health records viewed contained nude pictures taken as part of the medical services given by Mayo Clinic. The two lawsuits are scheduled for trial in 2022.