Washington State Department of Social and Health Services

On September 20, 2017, the covered entity (CE), Washington State Department of Social and Health Services, discovered that a breach incident occurred when a Western State Hospital staff member emailed a spreadsheet to another staff member and misdirected the email to a private email address. The breach involved the names, hospital admission dates, medical record numbers, birthdates, and diagnoses of 515 individuals. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE contacted the recipient of the email and ensured that the email and the attachment were deleted. As a result of OCR’s investigation, the CE implemented new procedures to further restrict access to patient information maintained by the hospital, implemented new procedures, performed a risk analysis, and retrained workforce members.