North Carolina Department of Health and Human Services

The covered entity (CE), the North Carolina Department of Health and Human Services, reported that an employee sent an unencrypted email that contained the electronic protected health information (ePHI) of 12,731 individuals. The ePHI involved included names and claims and treatment information. The CE notified HHS, affected individuals, and the media. In its mitigation efforts, the CE sanctioned the responsible individual and implemented additional administrative and security safeguards to better protect its ePHI.