Kelsey Research Foundation

The covered entity (CE), Kelsey Research Foundation, reported that an employee inadvertently disclosed patients’ email addresses. This breach affected approximately 1,128 individuals. The CE provided breach notification to HHS, affected individuals, and the media. During the investigation, OCR learned that the CE sanctioned the involved workforce member involved and revised its policy and procedures to better protect sensitive data. In addition, the CE trained all workforce members on the revised policy and procedures. OCR obtained assurances that the CE implemented the corrective actions noted above.