Heart Center of Southern Maryland, L.L.P

Between June 2, 2016 and June 7, 2016, a staff member of the covered entity (CE), Heart Center of Southern Maryland, LLP, copied patient profile information from the CE’s system and pasted it onto her computer. The staff member inappropriately permitted a third party to access her computer and disclosed the protected health information of 1,350 individuals who were treated by a physician who was leaving his employment with the CE. The CE provided breach notification to HHS, affected individuals, and the media. OCR obtained the CE’s Security Rule policies and procedures and confirmed that the CE provided employee training. OCR determined that the actions were committed by a rogue employee who is no longer employed with the CE.