Kentucky Counseling Center

The covered entity (CE), Kentucky Counseling Center, LLC, discovered that a former contractor sent a former staff member an email containing a list of 16,440 of the CE’s patients. The email contained protected health information (PHI), including demographic and health insurance information. The CE provided breach notification to HHS, affected individuals, and the media and also notified the FBI. In response to the breach, the CE adopted encryption technology, implemented two-factor authentication and strengthened password requirements. In addition, the CE retrained contractors and employees on HIPAA and added additional controls to its electronic medical record (EMR) system. The CE conducted a risk assessment and developed new policies and procedures. OCR obtained assurances that the CE implemented the corrective actions listed above.