Stephenville Medical & Surgical Clinic

The covered entity (CE), Stephenville Medical & Surgical Clinic, reported that an employee accidentally emailed a master list of patients whose charts had been purged and/or destroyed to an unauthorized recipient, resulting in the impermissible disclosure of the protected health information (PHI) of approximately 61,701 individuals. The PHI included demographic information. Following discovery of the breach, the CE sanctioned the employee responsible for the breach, implemented additional safeguards, and revised and updated its policies and procedures. OCR provided technical assistance regarding individual and media notification requirements and confirmed that the CE completed the required breach notifications. The CE also offered the affected individuals free credit monitoring services.