St. Francis Hospital

On May 30, 2014, a staff member sent an email to approximately 1,175 patients that erroneously permitted them to see the email addresses of all recipients. The covered entity (CE), St. Francis Hospital, investigated the incident, replaced its information technology department leadership and its security officer, and counseled the employee involved. Additionally, the CE updated its HIPAA policies and trained the entire workforce on its updated policies. The CE also began upgrading its equipment to better prevent security incidents. The CE provided breach notification to the affected individuals via e-mail message, sent notification to the media, and placed a conspicuous notice on its website. In response to OCR’s provision of technical assistance, the CE provided written notification to the affected individuals.