I fear that shallow stories like the one here just conceal the real problems and stir up FUD. What does it mean that "an employee" of a nursing home / rehab fa

I fear that shallow stories like the one here just conceal the real problems and stir up FUD. What does it mean that "an employee" of a nursing home / rehab facility accessed the records of almost five thousand patients? Some employees of such institutions have the duty to look at patient records to, for example, decide whether to offer these patients beds in their facilities. That can't be done properly without looking at the actual medical records: can the facility provide the prescribed physical therapy? occupational therapy? medications? wound care? If not, it's bad for the patient and the institution to accept the patient. That's the entire point of a medical record. What was this employee doing with the records? Running betting pools on whether his favorite professional ball player would show up (no good). Trying to find his ex-wife's records? (no good). Trying to make sure his facility could care for them properly? (good). Sellling their home addresses and the dates of their transfers out of the hospital to thieves with moving vans? (no good, and a genuine problem.) By the way, competent police read published obituaries and patrol the homes of families of deceased people during wakes and funerals because they know thieves do the same. What the heck good does credit monitoring do? Most of these patients need the help of a family member to actually make sense of credit monitoring. Oh, and it's unlikely any employee of a HIPAA-covered facility didn't get at least some confidentiality training. HIPAA and HITECH (ARRA 2009) patient privacy laws "pierce the corporate veil" and make officers and supervisors personally liable for intentional breaches. The popular press needs to get better at this cybersecurity beat.