The covered entity (CE), Wyoming Department of Health, transferred a copy of the Women Infants and Children benefit program backup database via the internet to a business associate using an unsecured method. Approximately 11,935 individuals were affected by the breach, potentially disclosing demographic information, dates of birth, gender, and identification numbers. The CE notified affected individuals, the media, and the Secretary. Following OCR’s investigation, the CE conducted an enterprise-wide risk analysis, developed a risk management plan, and revised its organizational structure in order to hybridize into covered and non-covered functions. OCR obtained assurances that the CE implemented these corrective action steps.
