University Hospitals

University Hospitals, the covered entity (CE), reported that an employee impermissibly accessed the electronic protected health information (ePHI) of 848 individuals. The ePHI involved included names, addresses, phone numbers, email addresses, dates of birth, health insurance information, Social Security numbers, drivers’ license numbers, financial information, and treatment information. The CE notified HHS, affected individuals, the media, and established a complimentary toll-free number for questions or concerns. In its mitigation efforts, the CE sanctioned the responsible employee and implemented additional administrative safeguards to better protect its sensitive data. OCR obtained assurances that the CE implemented the corrective actions noted.