AeroCare Holdings

AeroCare Holdings, the covered entity (CE), discovered that an employee sent an email that impermissibly disclosed the identity of email recipients and contained protected health information (PHI). The breach affected 858 individuals. The PHI contained in the email identified recipients as users of CPAP devices. The CE sent timely breach notification to HHS, to affected individuals, and to the media. In response to the breach, the CE prepared an incident report, revised its policies and procedures for emails, and sanctioned the responsible employee. OCR obtained assurances that the CE implemented the corrective actions listed above.