CHI Health Care, Inc.

On July 22, 2018, a former employee retained certain patient lists and other protected health information (PHI) after termination of employment and used some of this information to email a solicitation to approximately 722 patients of the covered entity (CE), offering nutrition services on October 4, 2018. The types of PHI involved in the incident included demographic and clinical information. The CE provided breach notification to HHS, affected individuals, and the media. The CE investigated the matter and ensured that all paper and electronic copies of the files were returned to the CE. The former employee has represented orally, and in a written and signed attestation, that the files were not downloaded, copied, retained, used, archived or re-disclosed to any other parties, other than in the email solicitation. Additionally, the CE has confirmed that its computer network and electronic medical record system are secure. Following the breach, the CE retrained its entire workforce members on two dates. The CE reviewed and updated its most recent risk assessment. OCR reviewed the notice sent to the affected individuals, as well as the security measures implemented to address risks and vulnerabilities. OCR obtained assurances that the CE implemented the corrective actions listed.