Oklahoma City-based OU Health has fired an employee who accessed 854 patients’ records without a legitimate business reason for about five months.
The health system became aware of the employee’s unusual pattern of accessing patient information around June 7 and opened an investigation with outside cybersecurity experts, OU Health said in a September notice. A review of access audit logs confirmed July 20 that the employee had viewed patient information between about Dec. 30, 2025, and June 7.
The information involved varied by patient. It included names, email addresses, phone numbers, patient photos, medical record numbers, gender, age, treatment details, admission dates, medication information, lab results, imaging, diagnoses and vital signs.
OU Health said it has no indication of fraud tied to the incident. The health system began notifying affected individuals around Sept. 20, and on Sept. 18 notified HHS’ Office for Civil Rights, which published the 854 figure in October.
