On January 19, 2018, Prestera Center for Mental Health Services, the covered entity (CE), discovered that an unauthorized user gained access to an employee’s email account and had the employee’s emails automatically forwarded to an external account. The breach affected 679 individuals and involved protected health information (PHI), including names, dates of birth, and insurance claims information. The CE provided timely breach notification to HHS, the affected individuals, and the media. Following the breach, the CE disabled the ability to automatically forward emails to an outside email account and trained employees on encrypting emails. OCR obtained assurances that the CE implemented the corrective actions listed and reviewed the CE’s risk analysis to ensure compliance with the Security Rule.
