Advanced Radiology Consultants

A patient scheduler of the covered entity (CE), Advanced Radiology Consultants, emailed 754 patients’ protected health information (PHI) from her work email account to a personal email account in order to keep a separate record for any performance issues. An additional 100 patients were affected by the breach because the scheduler had access to PHI about them in emails and a USB device (854 total individuals affected). The PHI involved in the breach included patients’ names, dates of birth, phone numbers, account balances, insurance information, treatment and examination information, appointment dates and times, appointment notes, and referring physicians’ information. Following discovery of the breach, the CE sanctioned the workforce member and requested that she delete the PHI she sent to her personal email account. The CE also provided breach notification to HHS, affected individuals, and the media, and provided individuals with credit monitoring services at no cost. OCR obtained assurances that the CE implemented the corrective actions listed above.