Lebanon VA Medical Center

An employee of the covered entity (CE) inadvertently emailed a document with protected health information (PHI) to an unintended recipient. The breach potentially affected the PHI of 993 individuals and included names and clinical information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE restricted the ability of certain documents to be opened by unintended recipients, and retrained staff members. OCR reviewed the CE's policies and procedures to ensure compliance with the Privacy and Security Rules and obtained assurances that the CE implemented the corrective action steps listed above.