Youth Opportunity Center, Inc.

The covered entity (CE), Youth Opportunity Center, Inc., reported that employees were sending protected health information (PHI) to its vendor without a need to know. The PHI involved included names and program information. This breach affected 1,150 individuals. The CE notified HHS, affected individuals, and the media. The CE sanctioned the staff members involved and provided additional training on patient privacy. In its mitigation efforts, the CE implemented additional administrative safeguards. OCR obtained assurances that the CE implemented the corrective actions noted.