An unauthorized individual obtained the network credentials of a Brigham and Women’s Hospital (BWH) employee and used the credentials to access the employee’s work email account and potentially the employee’s personal Gmail account, which contained work-related emails. The protected health information (PHI) of 1,009 patients was potentially accessed, including names, birthdates, medical record numbers, providers’ name, dates of service, diagnoses/conditions, and treatment information. Following discovery of the breach, the covered entity (CE) sanctioned the employee who was using her personal email for work-related purposes and re-trained all employees. Additionally, the CE enhanced its technical safeguards regarding network credentials. The CE provided breach notification to HHS, affected individuals, and the media, and established a dedicated call center to answer questions. OCR obtained assurances that the CE implemented the corrective actions noted above.
