Little Rock Plastic Surgery, P.A.

Little Rock Plastic Surgery, the covered entity (CE), reported that an employee impermissibly downloaded patient contact information and sent it to her personal email account. This breach affected approximately 6,300 individuals. The electronic protected health information (ePHI) involved included names, medications prescribed, and other demographic information. The CE notified HHS, affected individuals, and the media. In its mitigation efforts the CE implemented additional administrative and technical safeguards and retrained its staff. OCR obtained assurances that CE implemented the corrective actions noted.