South Carolina Department of Health and Human Services

The covered entity (CE), South Carolina Department of Health and Human Services, discovered that an employee sent Medicaid reports to her personal email from January 31, 2012, through April 4, 2012. The breach affected 228,435 individuals and the types of protected health information (PHI) involved in the breach included names, addresses, phone numbers, social security numbers and for 22,648 individuals, their Medicaid identification numbers. The CE provided timely breach notification to HHS, affected individuals, and the media. CE also posted notification about the breach on its website. In response to the breach, CE suspended access to most of its ad hoc electronic reporting, initiated a comprehensive review of its privacy and security safeguards, contacted local and federal law enforcement, and sanctioned the responsible employee. The CE also revised its security policies to restrict employee access to PHI to only that necessary for the individual’s job function and implemented an automated monitoring system to track user activity in its computer system. CE also implemented annual privacy and security training. OCR obtained assurances that the CE implemented the corrective actio