Hope Hospice

An email containing electronic protected health information (ePHI) was sent from a work email address to a home email address by a workforce member of the covered entity (CE), Hope Hospice. The ePHI in the email contained the names, referral sources, admission dates, and health insurers of approximately 818 individuals. Upon discovering the breach, the CE implemented sanctions against the involved workforce member. The CE provided breach notification to HHS, affected individuals, and the media. The CE improved physical security and retrained staff. OCR obtained assurances that the CE implemented the corrective actions listed.