Aegis Medical Group

Aegis Medical Group, the covered entity (CE), reported than an employee was using its patients’ protected health information (PHI) for nefarious purposes. This breach affected 8,454 individuals and the PHI involved included names, dates of birth, addresses, drivers’ license information, Social Security numbers, clinical information, health insurance information, diagnoses/conditions, lab results, medications prescribed, and other treatment information. The CE notified HHS, affected individuals, and the media. In its mitigation efforts, the CE sanctioned the employee, implemented additional administrative safeguards, and retrained its staff. OCR obtained assurances that the CE implemented the corrective actions noted.