United Methodist Homes

A workforce member of the covered entity (CE), United Methodist Homes, sent an email to his personal email account with a spreadsheet attachment that contained 843 residents’ protected health information (PHI). The spreadsheet included residents’ names, internal medical record numbers, as well as the names, addresses and phone numbers (and in some cases, email addresses) for each resident’s contact person(s) on file, and the contact person’s relationship with the resident. The CE provided breach notification to HHS, the media, and the affected individuals (including the offer of 12 months of credit monitoring services), and posted notice to its website. Following the breach, the CE sanctioned the responsible workforce member, implemented an email application that filters and quarantines any outgoing emails that contain ePHI, and enhanced Transport Layer Security (TLS) functionality to automatically encrypt such outgoing emails. OCR obtained assurances that the CE implemented the corrective actions listed. Additionally, the CE is expected to conduct a risk analysis, implement a corresponding remediation plan, and take certain actions to formalize its information system activity review activities.