Mo. Dept. of Mental Health

The covered entity, Missouri Department of Mental Health reported that the PHI of 5,685 individuals was compromised when a business associate (BA), Burrell Behavioral Health, reported that an unauthorized individual(s) accessed the email account of an employee which contained PHI from the covered entity. The employee sent thirteen (13) personal emails to the account of a third party. The email account which was impermissibly accessed contained electronic protected health information (ePHI) for approximately 7,748 patients. The ePHI included names, treatment, social security numbers, and financial information. The covered entity provided breach notification to HHS, affected individuals, and the media, and posted notice on its website. The business associate directed a third-party forensic information technology investigator to determine the cause and severity of the breach. The investigation concluded that the breach was limited to one employee’s email account. The business associate disabled email internet access globally for all employees. The business associate also sent out educational documents and reminders to all employees about password security and best practices for HIPAA