Saints Mary and Elizabeth Hospital

An employee of the covered entity (CE), Saints Mary and Elizabeth Hospital, sent an email reminder to potential participants of the hospital’s bariatric patient support group and inadvertently attached a spreadsheet of patients’ names associated with bariatric-related surgery. The spreadsheet contained the names, surgery dates, addresses, emails, and phone numbers of 1,682 individuals. The CE unsuccessfully tried to recall the message. The CE’s internal investigation determined that the involved employee failed to utilize the auto-encryption feature for email containing protected health information (PHI). The CE provided breach notification to HHS, affected individuals, and the media and posted substitute notices on its website. Following the breach, the CE retrained its employees on email policies and procedures and best practices for securing PHI sent through email. The CE sanctioned the involved employee and ceased using email to send reminders about support group activities. OCR obtained assurances that the CE implemented the corrective actions listed above.