Independent Health Association, the covered entity (CE), reported that an employee emailed documents containing the electronic protected health information (ePHI) of 7,605 individuals to the wrong recipient. The ePHI involved included names, diagnoses, claims data, clinical information, treatment information, and financial information. The CE notified HHS, affected individuals, and the media. In its mitigation efforts, the CE implemented new administrative safeguards, sanctioned the responsible employee, and retrained its staff. OCR obtained assurances that the CE implemented the corrective actions noted.
