Pulaski County Special School District-Employee Benefits Division

An employee responsible for reconciling health insurance billing data at Pulaski County Special School District—Employee Benefits Division, the covered entity (CE), sent copies of the reconciliations for 2,602 individuals to her home email account before she resigned. The emails contained former and current employees’ health insurance records, which included names, social security numbers, disability reports, employee payroll deductions and Employee Benefits Division reports. The CE provided breach notification to HHS, affected individuals, and the media. It also notified local law enforcement. OCR provided technical assistance regarding the CE’s obligations under the Breach Notification Rule, and implementing HIPAA policies and procedures. In response to the breach, the CE informed OCR that it would implement additional technical safeguards and preventative measures.