Northwest Behavioral Healthcare Services

National Behavioral Healthcare Services, the covered entity (CE), reported that one of its workforce members inadvertently emailed a spreadsheet containing protected health information (PHI) to one patient’s parent. The breach (which was initially reported as affecting more than 500) affected 498 individuals (patients and their guardians) and included names, birthdates, contact information, insurance company identification, and other identifying information. The CE provided breach notification to HHS and affected individuals. Following the breach, the CE conducted an investigation, counseled and retrained its workforce members and implemented safeguards, including placing additional restrictions on the use and disclosure of PHI. As a result of OCR’s investigation, the CE reviewed its policies and procedures, and revised its policies for using and safeguarding spreadsheet information. As of November 2017 the CE ceased doing business.