Center For Health Care Services

The Center for Health Care Services, the covered entity (CE), reported that a former workforce member impermissibly disclosed the electronic protected health information (ePHI) of 28,434 individuals to an unauthorized third party without authorization. The types of PHI disclosed included patients’ names, dates of birth, social security numbers, laboratory results, and dates of services. The CE provided breach notification to HHS, affected individuals, and the media. OCR obtained documented assurances that the CE created new policies, trained workforce members on its new policies, and improved technical safeguards to prevent similar incidents.