Mount Carmel Health System

An employee of the covered entity’s (CE) bariatric unit erroneously sent an email to post-bariatric patients identifying the entire list to all other patients. The breach affected approximately 836 individuals and included demographic information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE reeducated the employee responsible for the breach, revised its policy regarding electronic communications with patients (highlighting that e-mails sent to individuals external to the CE must be encrypted), and recalled emails sent to internal recipients that contained the email addresses. As a result of OCR’s investigation, the CE updated its Breach Notification Rule policy and trained staff. OCR obtained documented assurances that the CE implemented the corrective actions listed above.