Detroit Medical Center

The covered entity (CE), Detroit Medical Center, reported that an employee impermissibly disclosed protected health information (PHI) through unsecured text messages containing images of electronic health record content. The employee also printed and removed the paper copies from the CE’s facilities. The breach affected 1,529 individuals and the PHI involved included names, dates of birth, addresses, diagnoses/conditions, lab results, medications prescribed, and other treatment information. The covered entity notified affected individuals and media outlets. The covered entity sanctioned the employee involved and referred the incident to law enforcement for criminal prosecution. OCR obtained assurances that the CE implemented the corrective actions noted above.