Sutter Health East Bay Region

The Alameda County Sheriff’s office found a list of protected health information (PHI) belonging to 4,491 individuals during an unrelated investigation and provided it to the covered entity (CE), Sutter Health East Bay Region. The list contained demographic information such as names, addresses, dates of birth, social security numbers, and other identifiers. The CE determined that the PHI was stolen by a workforce member of its business associate (BA). The PHI belonged to patients of the following CE hosptials: Alta Bates Summit Medical Center, Sutter Delta Medical Center, and Eden Medical Center. The CE provided breach notification to HHS, the media, and affected individuals, and provided the affected individuals one year of free credit monitoring. Following the breach, the CE conducted an internal forensics investigation, hired an external forensics firm, and fully implemented data loss prevention technology. OCR obtained assurances that the CE implemented the corrective actions listed above. Additionally, the workforce member responsible for the breach is no longer employed by the BA.