Prairie Fields Family Medicine

On October 1, 2018, Prairie Fields Family Medicine, P.C., the covered entity (CE), discovered that an employee inadvertently emailed an unencrypted Excel spreadsheet, containing 6,450 individuals’ protected health information (PHI), to an unintended recipient. The types of PHI involved in the breach included demographic information, primary health insurers' names, and insurance policy numbers. At the time of the breach, the CE had implemented policies and procedures restricting its employee from sending PHI via unencrypted email. The CE provided breach notification to affected individuals, the media, and HHS. The CE also sanctioned the responsible employee and retrained all staff. Finally, the CE implemented an email encryption application for future email correspondence containing PHI. OCR verified that the CE revised its HIPAA policies and procedures that restrict impermissible uses and disclosures of PHI and require employees to safeguard PHI.