Tulare County Health & Human Services Agency

The covered entity (CE) reported a breach of 845 individuals’ electronic protected health information (e-PHI), as a result of a workforce member e-mailing information regarding logging into CE’s health care portal, without blind copying the patients, and encrypting the e-mails. This action, or lack thereof, left every patient’s e-mail address exposed. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE improved safeguards by changing and strengthening password requirements, disabling all patients’ health portal accounts, and implementing new technical safeguards. In addition, the CE required all affected patients to re-register with its online portal, and revised and implemented new policies and procedures. The CE sanctioned the workforce members involved and re-trained the entire workforce. OCR provided technical assistance regarding the HIPAA Security Rule and obtained documented assurances that the CE implemented the corrective actions listed above.