University of Texas System Administration

The CE sent an email reminder to approximately 794 COBRA participants regarding their premium due date that, inadvertently, displayed the email addresses of all individuals who received the reminder. The email contained names and identified individuals as a plan participant. Upon discovering the breach, the CE implemented additional technical safeguards to prevent similar incidents from occurring. The CE sanctioned the workforce member responsible for the error and re-trained workforce members on its policy regarding the emailing of electronic PHI. The CE provided breach notification to HHS, affected individuals, and the media. The CE also amended its Breach Notification policies and procedures to better clarify the notice requirements specified under the Breach Notification Rule. OCR obtained assurances that the CE implemented the corrective actions listed.