St. Vincent's Ambulatory Care

The covered entity (CE), St. Vincent’s Ambulatory Care, reported that an employee of its third-party partner impermissibly accessed the protected health information (PHI) of 768 individuals. The PHI involved included names, addresses, phone numbers, email addresses, Social Security numbers, medical record numbers, and financial and health insurance information. The CE notified HHS, affected individuals, the media, and provided substitute notice. In response to the breach, the CE provided complimentary credit monitoring services, sanctioned the responsible employee, and implemented additional administrative and technical safeguards.