Adams County

The covered entity (CE), Adams County Health and Human Services Department (Adams County), a hybrid health care entity, reported that two employees impermissibly accessed protected health information (PHI). This breach affected 258,120 individuals. The CE notified affected individuals, the media, and HHS. Adams County also sanctioned the employees, locked down the affected programs, and its IT service provider reset all access credentials across its network. OCR provided the CE with technical guidance regarding its obligations under the HIPAA Security Rule and Breach Notification Rule.