CenterLight Healthcare

A workforce member emailed to his personal email address files containing the protected health information (PHI) of 642 individuals, including their names, Medicare numbers, Medicaid numbers, enrollment status, and some health plan names. The workforce member was a temporary worker who had intended to show his work product to potential employers to demonstrate his experience with such work. The covered entity (CE), CenterLight Healthcare, provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE ensured that the temporary worker deleted the email at issue from his personal email account and personal mobile device. The CE also attempted to secure the temporary worker’s written acknowledgment that confirmed that he either (i) did not save the files to his home desktop computer or (ii) deleted the files from his home desktop computer. The CE also sanctioned the worker. Additionally, the CE stopped using temporary workers, implemented an email encryption solution, and revised its HIPAA training. OCR obtained assurances that the CE implemented the corrective actions listed.