CCRM Dallas-Fort Worth

OCR opened an investigation of the covered entity (CE), CCRM – Fort Worth, after it reported that an unauthorized user gained access to a former workforce member’s email account. The incident affected the electronic protected health information (ePHI) of approximately 1,117 individuals and included demographic, financial, and clinical information. Upon discovering the breach, the CE disabled the affected email account and implemented new technical safeguards relating to its email platform. The CE provided breach notification to HHS, affected individuals and the media and also posted substitute notice. Further, the CE offered one year of free identity theft services to affected individuals. OCR obtained assurances that the CE implemented the listed corrective actions.