The covered entity (CE), Missouri Department of Mental Health, reported that an employee erroneously sent an unencrypted email message containing the protected health information (PHI) of 537 individuals to the wrong individuals. The PHI involved included names, Social Security numbers, addresses, and dates of birth. The CE notified HHS, affected individuals, and the media. In response to the breach, the CE implemented additional administrative, technical, and security safeguards. Staff were retrained.
