University of Oklahoma, OU Physicians

The covered entity (CE), University of Oklahoma Health Sciences Center, reported that a resident physician set his university email to automatically forward to his personal email account. The protected health information (PHI) involved the names, medical information, dates of birth, and social security numbers for approximately 1,637 individuals. As a result of the breach, the CE improved safeguards, updated its policies and procedures, and trained its workforce members on better practices to protect PHI. Further, the CE provided breach notification to HHS, affected individuals, and the media. During the course of the investigation, OCR provided technical assistance, and the CE provided substitute notice to those individuals not notified. OCR obtained the notice to the media provided by the CE, and obtained assurances that the CE implemented the corrective actions listed in the response to OCR’s data request and the breach report.