The covered entity (CE), Rutland Regional Medical Center, sent 668 patient surveys via email to recently discharged patients. The recipient’s email address was placed in the “To” line of the emails making each recipient’s email address, which contained names, visible to all other recipients. Of the 668 emails in the address lines, three were duplicates, leaving 665 patient email addresses disclosed. The CE provided breach notification to HHS, affected individuals, and the media. The CE also set up an assistance help line for individuals who might have additional questions. As a result of OCR’s investigation, the CE revised its policies regarding using and disclosing protected health information and sending patient emails. Additionally, the CE re-trained its staff on its HIPAA policies. OCR obtained assurances that the CE implemented the corrective actions noted above.
