Salina Health Education

An employee of the covered entity (CE), Salina Family Healthcare Center, sent an email containing electronic protected health information (ePHI) to a third party as part of a research case study. The types of PHI involved in the breach included names, dates of birth, addresses, chart numbers, and procedure codes affecting approximately 9,640 individuals. The CE provided breach notification to HHS, affected individuals, and the media. The CE responded to the breach by obtaining assurances that the email was destroyed by the third party, and sanctioning the responsible employee. As a result of OCR’s investigation, the CE updated and trained staff on its policies relating to the e-mailing of PHI and uses and disclosures of PHI.