The University of Texas MD Anderson Cancer Center

On May 3, 2018, the covered entity (CE), the University of Texas MD Anderson Cancer Center, discovered that a workforce member erroneously sent a research recruitment email to 1,266 individuals in a manner that allowed them to be seen by the other email recipients. The CE determined that some emails were undeliverable and it stopped others; however, it is believed 599 emails were delivered. The CE provided breach notification to HHS, affected individuals, and the media. In response to the breach incident, the CE implemented a new technical safeguard and re-educated workforce members concerning policies, procedures, and tips to prevent impermissible disclosures of PHI involving email. The CE also sanctioned the involved workforce member. OCR obtained assurances that the CE implemented the corrective actions listed above.