Braun Internal Medicine

On May 17, 2017, Braun Internal Medicine, P.C., the covered entity (CE), sent emails to 680 patients notifying them about a business transition. The “blind copy” feature was not used in the email and all the recipients could see the email addresses for the other recipients. The exposed protected health information (PHI) was limited to email addresses. The email contained no other PHI. In response to the breach, the CE sanctioned the responsible employee and implemented a new policy with procedures for safeguarding PHI in emails. The CE has trained all employees on the new procedures. The CE provided breach notification to HHS, affected individuals, and the media. OCR obtained assurances that the CE implemented the voluntary corrective actions noted above.