Thielen Student Health Center

Thielen Student Health Center, the covered entity (CE), sent patient survey invitation emails to the wrong patients on November 5, 2018, due to a human coding error. Initially, the CE reported that 599 individuals were affected by the breach; however, the information in 594 of the erroneously addressed emails implicated the Family Educational Rights and Privacy Act (FERPA), rather than HIPAA. Additionally, the CE was able to successfully recall one of the five emails containing electronic protected health information (ePHI); therefore, only ePHI belonging to four individuals was breached under HIPAA. The breached ePHI included patients' names, appointment dates, and physician's names. The CE provided breach notification to the affected individuals, the media, and HHS. The CE revised its patient survey emails to no longer contain ePHI, retrained the employee responsible for the breach, and provided OCR with written assurances that it would revise and implement Privacy Rule policies and procedures.