Hillsides

A workforce member emailed documents containing personally identifiable information (PII) and protected health information (PHI) of patients and employees to a personal email address. The breach involved the PII and PHI of 970 individuals. The breached information included names, dates of birth, patient identification numbers, and health care provider information. Following the breach, the covered entity (CE), Hillsides, provided breach notification to HHS, affected individuals, and the media. It also sanctioned the workforce member involved, implemented safeguards, and retrained staff. OCR obtained assurances that the CE implemented the corrective actions listed above.