Between July 6 and 7, 2016, an unauthorized individual(s) accessed the email account of an employee at the covered entity (CE), Burrell Behavioral Health, and sent thirteen (13) personal emails to an account believed to be the employee’s ex-boyfriend. The email account which was impermissibly accessed contained electronic protected health information (ePHI) for 7,748 patients. The ePHI included names, treatment, social security numbers, and financial information. The CE provided breach notification to HHS, affected individuals, and the media, and posted notice on its website. The CE directed a third-party forensic information technology investigator to determine the cause and severity of the breach. The investigation concluded that only the one employee’s email account was breached. The CE disabled email internet access globally for all employees. The CE also sent out educational documents and reminders to all employees about password security and best practices for HIPAA and network security. The CE also provided one year of identity and credit protection to affected individuals. OCR obtained assurances that the CE took the voluntary corrective actions listed above.
