Braun Dermatology & Skin Cancer Center

The covered entity (CE) sent an email to patients that failed to conceal the email addresses of the other recipients. The breach included the protected health information (PHI) of 1,200 individuals, specifically email addresses. Following the breach, the CE's Privacy Officer worked with its Information Technology (IT) Department to attempt to recall the message. The CE performed a breach risk assessment and determined there was a low risk of compromise to patients’ PHI. The CE implemented a new policy and procedure whereby it eliminated mass emails and will send individual emails through a secure patient reminder system. OCR obtained assurances that the CE implemented the corrective actions noted.