The covered entity (CE), Washington D.C VA Medical Center, reported that an employee impermissibly sent the protected health information (PHI) of 1,193 individuals to a personal email account. The PHI involved included names, diagnoses, lab results, medications, and Social Security numbers. The CE notified HHS, affected individuals, and the media. In response to the breach, the CE retrained its employees regarding the HIPAA Rules.
