The covered entity (CE), Mt. Sinai, discovered that an employee was printing paper face sheets in excess of her job duties for an illicit purpose. The face sheets contained the demographic and clinical information of 1,406 individuals. The CE provided breach notification to HHS, affected individuals, and the media. In response to the breach, the CE altered its policies to limit the users allowed to print face sheets. In addition, the CE retrained its workforce and disseminated educational material. OCR obtained assurances that the CE implemented the corrective actions listed. The CE also terminated the employment of the involved employee.
