MorshedEye

From January 10, 2018, through February 16, 2018, MorshedEye, the covered entity (CE), sent group emails to 762 patients to inform them of its new location; however, the emails were not blind copied, so recipients could view the names and email addresses of other patients. The protected health information (PHI) in the emails included names and email addresses. OCR provided technical assistance to the CE regarding the CE’s breach notification responsibilities, the definition of PHI, training, and business associate agreements. In response to OCR’s investigation, the CE revised its notice of privacy practices, added a complaint policy to its notice of privacy practices, developed a security and awareness training program, and compiled HIPAA guidance materials into a binder. The CE also performed an initial risk analysis, and sent breach notification to HHS, the affected individuals, and to the media. OCR obtained assurances that the CE implemented the corrective actions listed above.