Susquehanna Health

In response to an insurer’s routine claims request, an employee provided more protected health information (PHI) than was necessary to complete the intended purpose. Approximately 657 patients were affected. The impermissible disclosure included patients’ names, addresses, social security numbers, dates of birth, health insurance information, payment information, encounter identification, physicians’ names, diagnosis codes, and patients’ employers. The covered entity (CE), Susquehanna Health, provided breach notification to HHS and affected individuals. The CE also offered one year of free identity theft protection and credit monitoring to affected individuals. Following the breach, the CE immediately ensured that all recipients of the PHI deleted the data from their computers and shredded all hard copies. OCR obtained and reviewed copies of the CE’s policies and procedures related to the issues raised in this complaint, as well as a copy of its current risk assessment. As a result of OCR’s investigation, the CE sanctioned the staff member, retrained the entire department, and revised its email policies.