Multnomah County, the covered entity (CE), reported that a workforce member automatically forwarded all of his work emails to his personal email account for over four years. Approximately 1,200 individuals’ electronic protected health information (ePHI) was affected by the breach and included clinical and demographic information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE sanctioned the workforce member responsible for the breach and provided reminders to workforce members on the proper use of email accounts. In response to OCR’s investigation, the CE implemented a process to perform a monthly review of the CE’s email users that have automatic forwarding. As a result of the investigation, the CE is expected to conduct a complete and thorough risk analysis and implement a corresponding risk management plan in conformance with the HIPAA Rules.
