Dent Neurologic Institute

A workforce member of the covered entity (CE), Dent Neurologic Group, LLP erroneously sent an unencrypted email with a spreadsheet containing 10,202 patients’ protected health information (PHI) to the wrong patients. The types of PHI in the spreadsheet included patients’ names, addresses, active/former patient status, dates of last appointments, scheduling codes, and physicians’ names. The CE provided breach notification to HHS, affected individuals and the media. Following the breach, the CE implemented an email security appliance that encrypts emails and filters incoming messages for malware, viruses and spam as well as filter outgoing messages for identifiers. The CE also updated its email encryption policy and procedure, implemented its policy and procedure for encryption and password protection of electronic documents, and updated its training program for handling emails. Additionally, the CE sanctioned, counseled and retrained the workforce member. As a result of OCR’s investigation and technical assistance, the CE provided evidence of its remediation of Windows XP devices as well as an updated risk analysis to incorporate physical safeguards, penetration testing, and a corre