North Texas Medical Center

The covered entity (CE), North Texas Medical Center, inadvertently provided two unredacted e-mails to a member of the public in response to a public information act request that was made under state law. The incident compromised the protected health information (PHI) of 3,368 individuals and included demographic and clinical information. The CE notified HHS, the affected individuals and the media. Following the breach, the CE updated its policies and training to its workforce members to prevent a similar event from occurring in the future. OCR obtained assurances that the CE implemented these corrective actions.