Georgia Department of Human Services, the business associate (BA), reported that an employee impermissibly disclosed the electronic protected health information (ePHI) of 596,065 individuals. The ePHI involved included names, birthdates, addresses, and other demographic information. The BA notified HHS, affected individuals, and the media. In its mitigation efforts, the BA sanctioned the responsible individuals and retrained its staff on key elements of the HIPAA Rules requiring the safeguarding of ePHI. OCR provided technical assistance to the BA on performing an accurate and thorough risk analysis. OCR obtained assurances that the BA implemented the corrective actions noted.
