Camas Center Clinic, Kalispel Tribe of Indians

An employee of the covered entity (CE), the Kalispel Tribe of Indians, Camas Center Clinic, gave an “on-call” temporary administrative assistant at the CE’s facility, who had not yet been trained in HIPAA, the employee’s personal login and password information. The assistant used the login/password information to access electronic protected health information (ePHI) on the employee’s computer. When the information technology department learned of this impermissible access, it quickly disabled the employee’s login information, as the ePHI had been shared in violation of the CE’s policies. In addition to ePHI, the assistant also accessed paper PHI. The breach affected approximately 504 individuals and the types of PHI and ePHI involved included demographic, financial, and clinical information. The CE provided breach notification to the affected individuals, the media, and HHS. The CE sanctioned the employee pursuant to its policies for impermissibly sharing the login/password information and retrained its workforce members on HIPAA. OCR obtained assurances that the CE implemented the corrective action measures described.