The covered entity (CE), Shands Teaching Hospitals and Clinics, Inc., reported that an employee impermissibly accessed the protected health information (PHI) of 1,562 individuals. The PHI involved included names, addresses, phone numbers, dates of birth, diagnoses, and lab and/or imaging results. The CE notified HHS, affected individuals, the media, and posted substitute notice on its website. The CE also provided complimentary credit monitoring services. In its mitigation efforts, the CE sanctioned the responsible employee, strengthened its administrative safeguards, and retrained its staff.
