Terrell County Health Department

On December 6, 2012, the Dawson Police Department notified the covered entity (CE), Terrell County Health Department, that an employee was suspected of the identity theft of at least two of the CE’s patients. All patients that the employee had access to records for during her employment were potentially affected, totaling 18,000 individuals. The protected health information (PHI) involved in the breach included demographic, clinical, financial, and health insurance information. The CE provided breach notification to HHS, affected individuals, and the media. The CE terminated the offending employee and re-educated the workforce on its HIPAA policies. The CE also improved its HIPAA training materials, risk analysis procedure, operation software, and auditing methods. OCR obtained assurances that the corrective actions were taken.