The covered entity (CE), Henry Ford Health System (HFHS), reported that an employee inadvertently sent an email containing protected health information (PHI) to an incorrect email address. This breach affected 1,404 individuals. The PHI involved included names, dates of birth, medical conditions, and lab results. HFHS notified HHS, affected individuals, and the media. HFHS also retrained its employees on the importance of checking email addresses before sending emails. The CE implemented additional administrative and technical safeguards to further protect its PHI. OCR obtained assurances that the CE implemented the corrective actions noted above.
