West Kendall Baptist Hospital

On March 9, 2018, West Kendall Baptist Hospital, the covered entity (CE), discovered that an employee was using patient credit card numbers to make personal purchases. The breach affected 1,480 individuals and involved protected health information including credit card numbers, names, and addresses. The CE provided timely breach notification to HHS, the affected individuals, and the media. In response to the breach, the CE sanctioned the responsible employee, and added information to the reports it receives from its credit card vendor about how electronic purchases are processed by employees. The CE also developed new policies, included information about the breach in its annual training, and retrained its staff members. OCR obtained assurances that the CE implemented the corrective actions listed above.