OCR opened an investigation of the covered entity (CE), Dallas County Hospital District dba Parkland Health & Hospital System, after it reported that a former workforce member, while still employed, downloaded the names and certain personal information of its patients. The electronic protected health information (ePHI) involved in the breach included names, social security numbers, dates of birth, and other demographic information of approximately 2,464 individuals. The downloaded information was used to solicit potential clients in the workforce member’s personal business, a home health agency. The CE provided breach notification to HHS and affected individuals and offered free credit monitoring services for a year. Further, the CE terminated the workforce member who was involved in the incident and pursued criminal charges against him. As a result of OCR’s investigation, the CE developed a program to track anomalies to detect inappropriate use or access. Further, the CE revised its code of conduct and ethics to increase focus on conflicts of interest and confidentiality of PHI.
