Cardiology Associates

A Cardiology Associates’ employee mailed patients’ protected health information (PHI) to her personal email address without a legitimate business purpose. The breach included the PHI of 907 individuals and included names, dates of birth, and social security numbers. Following the breach, the covered entity (CE) sanctioned the employee, which included termination in this case, and notified the Federal Bureau of Investigation. OCR reviewed the CE's risk assessment to ensure compliance with the Security Rule.