Open Cities Health Center

The covered entity (CE), Open Cities Health Center, reported that an employee impermissibly transmitted electronic protected health information (ePHI) via the Internet to its business associate (BA). The breach affected approximately 1,304 individuals. The ePHI involved included names and dates of birth. The CE notified HHS, affected individuals, the media, and posted substitute notice on its website. In response to the breach, the CE sanctioned the responsible employee, revised its policies and procedures, and retrained its workforce members on the proper methods of transmitting ePHI. OCR provided technical assistance to the CE regarding the Breach Notification Rule and obtained assurances that the CE implemented the corrective actions noted.