Colorado River Indian Tribes

An employee of the covered entity’s (CE) health care component, Department of Health and Human Services, emailed a file containing electronic protected health information (ePHI) to his personal web-based email account in October 2013 to complete his work off-site. The breach affected the ePHI of 1,296 individuals, including demographic, financial, clinical, and other information. The CE provided breach notifications to individuals, the media, and HHS. Following the breach, the CE sanctioned the involved employee and retrained employees. It also strengthened its administrative, technical and physical safeguards for ePHI, analyzed risks to its ePHI, and took steps to manage risks regarding ePHI. It also revised its written security policies and procedures. OCR obtained assurances that the CE implemented the corrective actions noted above.