Consolidated Tribal Health Project

Consolidated Tribal Health Project (CTHP), the covered entity (CE), reported that an employee may have impermissibly accessed the protected health information (PHI) of 4,885 individuals via CTHP’s computer systems prior to the employee’s termination on October 31, 2014. CTHP reported this unauthorized access to local law enforcement and retained third-party forensic experts to determine the nature and scope of this data security event. CTHP also notified the California Department of Public Health. CTHP reported that no PHI was compromised as a result of the breach. CTHP provided notification to the media and all affected individuals. As a result of OCR’s investigation, CTHP revised its policies and procedures regarding the administrative, physical, and technical safeguards for protecting PHI and re-trained its workforce members. In addition, copies of these policies and procedures were provided to all staff.