The covered entity's (CE) staff physician emailed the protected health information (PHI) of approximately 2,900 individuals to his home email account while working on an analysis. The PHI included names, addresses, dates of birth, social security numbers, and medication information. Following the breach, the CE sanctioned the physician and implemented a plan to auto-encrypt all PHI sent through email. As a result of OCR's investigation, the CE improved its physical safeguards and retrained employees. \ \
