Lanier Family & Cosmetic Dentistry

On October 24, 2018, via a business associate (BA), an employee sent emails to 1,953 patients that erroneously contained a spreadsheet that listed protected health information (PHI) for all recipients of the message. The spreadsheet included names, genders, ages, addresses, telephone numbers, and email addresses. Immediately following the breach, the covered entity (CE) sent an apology email to the affected individuals, sanctioned the responsible employee, trained all employees on its new email policy, and terminated its contract with the BA. OCR provided the CE with extensive technical assistance regarding the definition of a breach, breach notification, policies and procedures, and BA agreements. In response to OCR’s investigation, the CE reviewed, revised, and drafted new policies and procedures and provided breach notification to HHS, affected individuals, and the media. OCR obtained assurances that the CE implemented the corrective actions listed above.