Hospice of the Chesapeake

Contrary to the covered entity's (CE) established policy, an employee emailed spreadsheets containing the electronic protected health information (ePHI) of 7,035 patients to a personal email account, and a third party may have viewed the spreadsheets. The PHI included names, addresses, conditions, and diagnoses. Following the breach, the CE hired an independent computer forensics firm which conducted an independent investigation. The investigation uncovered another spreadsheet containing the PHI of 571 additional patients in the employee's personal email account. The CE provided breach notification to affected individuals, the media, and HHS, and posted substitute notice on its website. The CE applied sanctions for violating its policy and terminated the responsible employee. As a result of OCR's investigation, OCR obtained assurances that the CE has periodically conducted risk assessments to assess vulnerabilities to ePHI in its computer systems.