University of Iowa Hospital and Clinics officials said they will fire three employees and put two more on unpaid suspensions after they allegedly inappropriately accessed the electronic medical records of 13 Hawkeye football players who were hospitalized last week.

In a statement released Thursday, UIHC officials announced they had completed a review of the incident and are “in the process” of terminating the three employees. The other two will receive five-day unpaid suspensions.

UI spokesman Tom Moore declined to comment further on the employees’ status and said all 13 student-athletes have been made aware of the accessed records.

“Every year, all faculty and staff members of UIHC are required to sign a contract stating they understand the policy and the repercussions of breaking the policy are made very clear,” Moore said.

The 13 Hawkeye football players were hospitalized last week for rhabdomyolysis, which involves the release of muscle fiber contents into the bloodstream, and can result in kidney damage. The hospitalizations apparently followed intense off-season workouts. All 13 players have since been released from the hospital.

“Having our players released from the hospital over the course of the weekend was an extremely positive occurrence for us,” Iowa head football coach Kirk Ferentz said at a press conference Wednesday. “Happy to say that they’re all progressing well.”

UIHC requires all employees to go through extensive Health Insurance Portability and Accountability Act Privacy Rule training.

The privacy rule establishes nationwide standards that prevent any health-care provider from disclosing medical information about a patient without her or his consent. The rule provides protection of the privacy of personal health information and sets limits on disclosures, which can be made without a patient’s consent, giving patients full rights over their health information.

“It’s a serious violation of a patient’s privacy rights to disclose medical information without having her or his permission,” said UI law Professor Sheldon Kurtz. “I think it’s terrible.

But UIHC itself is likely safe from any potential lawsuits, he said. Usually, when an employer has employees sign a contract as precise and specific regarding these standards as the one UIHC staff sign, the employer can’t be held responsible for what an employee may do.

Thus, the 13 hospitalized players likely wouldn’t be able to sue to the UIHC over the incident, Kurtz said.

“There’s only so much that an employer can do,” he said. “Knowing what I know about UIHC, I can’t imagine that it’s terminating these employees to protect its own liability.”

In November 2008, eight UIHC employees were disciplined for viewing restricted patient information. One employee was terminated, and seven others were suspended without pay.