St. Louis Children's Hospital

St. Louis Children’s Hospital, the covered entity (CE), reported that employees emailed protected health information (PHI) in an unsecure manner. This breach affected 643 individuals and the PHI involved included names, addresses, telephone numbers, dates of birth, Medicaid numbers, medications prescribed, and clinical information. The CE notified HHS, affected individuals, the media, and established a call center for all individuals affected. As a result of the breach, St. Louis Children’s Hospital implemented additional administrative and technical safeguards and retrained its staff on the HIPAA Rules and the methods for using secure email communications. OCR obtained assurances that the CE implemented the corrective actions noted.