On or about December 18, 2015, the covered entity (CE), Val Verde Regional Medical Center, determined that a member of its medical staff had impermissibly used protected health information (PHI) and sent unsecured emails containing PHI to two unapproved, personal email addresses. The emailed PHI included patients' names, genders, medical record numbers, dates of birth, modalities, study dates, ages, telephone numbers and/or account numbers, affecting 2,412 individuals. the CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE revised policies and procedures and retrained staff. The CE conducted a new risk analysis and took actions to mitigate identified risks. During the investigation, OCR provided technical assistance regarding multiple standards of the HIPAA Rules.
