On May 7, 2018, University of Texas Physicians, the covered entity (CE), discovered one of its workforce members sent an email disclosing the protected health information (PHI of 2,793 patients to other patients listed on the email. The workforce member inserted multiple patient email addresses into the “to” field rather than the “blind carbon copy” or “bcc” field, which allowed the patients to see each other’s email addresses. In response to the incident, the CE implemented technical safeguards to prevent similar situations and retrained its workforce members on the proper use of email when communicating with patients. Following the incident, the CE also provided evidence it notified affected individuals and the media. OCR obtained assurances that the CE implemented the corrective actions listed.
