Central City Concern

Law enforcement investigated a former employee of the covered entity (CE), Central City Concern, for identity theft and notified the CE that the former employee admitted to misusing approximately 15 Employment Access Center (EAC) clients’ information. The personal information involved in the breach included names, social security numbers, addresses, dates of birth and other identifiers, but no data from the CE’s health care component. The CE provided breach notification to HHS, the media, and all 17,914 clients whose information was accessible by the former employee, as well as posting substitute notice on its website. It also provided a year of free credit monitoring for affected individuals. As a result of the incident, the CE improved safeguards for the EAC database. The CE also contracted with a third party to complete a security risk assessment of all its locations and updated its privacy and security policies and procedures. OCR’s investigation confirmed that the appropriate notifications were made and that corrective actions steps were taken.