The covered entity (CE), the University of Iowa Hospitals and Clinics, reported that an employee emailed the protected health information (PHI) of 950 individuals to other members of a research study without authorization. The PHI involved included names, email addresses, and diagnoses/conditions. The CE notified HHS, affected individuals, the media, and established a toll free number for questions or concerns. In its mitigation efforts, the CE implemented additional administrative safeguards and retrained its staff on privacy protections. OCR obtained assurances that the CE implemented the corrective actions noted.
