On September 1, 2016, the Veteran’s Health Administration – Eastern Colorado Healthcare System, the covered entity (CE), discovered that one of its workforce members emailed a spreadsheet containing 2,130 veterans’ protected health information (PHI) to his personal email account and later published the PHI in a book on Amazon. The PHI included affected individuals’ full names, diagnoses, and the last four digits of their social security numbers. The Amazon book contained the personal telephone numbers for four individuals. Based on these breaches and OCR’s investigation, the CE provided breach notification to the affected individuals, the media, and HHS and offered credit monitoring and contact information for affected individuals with questions regarding the breach. In addition, the CE provided OCR with written assurance that it is notifying the four individuals whose PHI appeared in the Amazon-published book. The CE also investigated the incident and mitigated the effects of the breach by training the involved workforce member (prior to his resignation) and working with Amazon to remove the book from the retail website. During the investigation, OCR provided the CE with technical
