Health Texas Provider Network - Cardiovascular Consultants of North Texas

A former employee of the covered entity (CE), Baylor Health Care System and Health Texas Provider Network – Cardiovascular Consultants of North Texas, continued to access its appointment reminder system for nearly two months after employment ended. The former employee accessed the protected health information (PHI) of 2,462 individuals, including patients’ names, phone numbers, appointment times and dates, reason for appointments, physicians’ names and facility names. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE terminated the former employee’s system access, modified its access termination protocol, and sanctioned and retrained involved staff. As a result of OCR’s investigation, OCR obtained assurances that the corrective actions listed above were completed.