Real$-$World Case $13\mathrm{.}2$

Caring Hospice has found that they had violated two security standards. They found that employees were not being removed from the information system after they left the organization. An audit of the users of the information system found $45$ employees who no longer worked at the hospice. They also realized that they were not consistently monitoring access to the ePHI. In the past $12$ months, access was only audited twice. They did not find any evidence of breaches. After finding these security violations, the hospice decided to evaluate their entire security program.