Rocky Mountain Spine Clinic

The covered entity (CE), Rocky Mountain Spine Clinic, reported that an employee sent an email containing the protected health information (PHI) of approximately 532 patients to her personal email account. The PHI involved in the breach included names, social security numbers, insurance numbers and information, descriptions of procedures, and treating physicians' names. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE sanctioned the employee, ensured the PHI was no longer on the employee’s personal computer and email account, and retrained its staff on relevant Privacy and Security Rules’ provisions. OCR obtained copies of the CE's HIPAA policies and procedures and obtained assurances that the CE implemented the corrective actions noted above.