The covered entity (CE), Spectrum Health System, reported that a workforce member impermissibly accessed and collected the protected health information (PHI) of 794 individuals. The PHI involved included names, addresses, phone numbers, and email addresses. The CE notified HHS, affected individuals, the media, and provided substitute notice. In its mitigation efforts, the CE sanctioned the workforce member and placed the workforce member on a list to prevent future access to any affiliated CE systems.
