TriHealth Physician Practices

The covered entity (CE), TriHealth Physician Practices, reported that an employee impermissibly disclosed the protected health information (PHI) of 2,433 patients to a student mentee who was not authorized to view PHI. The PHI involved included names, addresses, dates of birth, ethnicity, diagnoses/conditions, and other treatment information. The CE notified HHS, affected individuals, the media, and established a hotline for all individuals affected who may have questions or concerns. In its mitigation efforts, the CE sanctioned the responsible employee and retrained its staff on the importance of protecting patient privacy. The CE also implemented additional administrative safeguards to better protect its data. OCR obtained assurances that the CE implemented the corrective actions noted.