Hope Community Resources

A client contact list was inadvertently attached to a group email to parents and guardians of clients by an employee of the covered entity (CE), Hope Community Resources, affecting 1,556 individuals. The protected health information (PHI) involved in the breach included client names, contact information for client support persons, dates of birth, and internal identification numbers issued by the CE. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE sanctioned the responsible employee and improved safeguards by instituting new quality measure for large mailings. Following OCR’s investigation, the CE updated its risk analysis through an outside vendor.