A workforce member sent an email to 1,359 patients without using the “blind carbon copy” or “bcc” field, which allowed the patients to see each other’s email addresses. The covered entity (CE) provided breach notification to HHS. affected individuals, and the media. In response to the incident, the CE updated technical safeguards and re-trained its workforce members on the proper use of email when communicating with patients. OCR obtained assurances that the CE implemented the corrective actions listed above.
