Family Medical Group Northeast

The covered entity (CE) reported that on July 27, 2018, a workforce member erroneously sent an email containing protected health information (PHI) to 200 patients, potentially affecting approximately 2,077 individuals. The types of PHI involved in the breach included patients’ names, dates of birth, email addresses, and medical records numbers. The CE provided breach notification to HHS, affected individuals, and the media, posted substitute notice on its website, and selected a dedicated staff member for individuals to call with any questions. The CE counseled the involved employee, revised its PHI Data Extraction and Transmission policy, and retrained all workforce members on the issues raised in the breach. OCR provided substantial technical assistance to the CE and obtained assurances that the CE implemented the corrective actions noted above.