Diana S. Guth

The covered entity (CE), Home Respiratory Care, reported a breach of 1,285 individuals’ electronic protected health information (ePHI), as a result of a workforce member emailing holiday cards and newsletters to its patients in a group email without masking the recipients' addresses. This action, or lack thereof, left every recipient's email address exposed, which may have included names, as well as an implicit indication that the individual had received respiratory treatment. The CE provided OCR with evidence that it responded to the security incident and undertook steps to prevent the risk of future security incidents by implementing new mail merge safeguards; implementing new, technical safeguards; sanctioning the workforce members involved; and re-training the entire workforce. OCR provided technical assistance regarding the HIPAA Security Rule.