The covered entity (CE), California Department of State Hospitals, reported that an employee impermissibly accessed the electronic protected health information (ePHI) of 5,014 individuals. The ePHI involved included names, addresses, dates of birth, phone numbers, email addresses, diagnoses, lab results, and other treatment information. The CE notified HHS, affected individuals, and the media. In response to the breach, the CE sanctioned the employee and strengthened its policies and procedures. OCR provided technical assistance to the CE.
