A staff member of the covered entity (CE), Oklahoma City Indian Clinic, sent an email to 412 recipients that erroneously included an attachment that contained the electronic protected health information (ePHI) of 6,044 individuals. Following an attempted recall of the message, a corrected email without the attachment was sent, asking the recipients to delete the erroneous email and the attachment. The ePHI involved in the breach included patients’ names, chart numbers, and email addresses. The CE provided breach notification to HHS, affected individuals, and the media, and provided substitute notice. Following the breach, the CE re-trained staff on its encryption policy. In addition, the CE improved safeguards by developing a policy regarding electronic transmission of patient information. The policy limits identifying patient information contained in electronic communications within the CE’s network, and requires password protection for electronic files including ePHI. As a result of OCR’s investigation, OCR obtained assurances that the corrective actions listed above were completed.
