Memorial Hospital at Gulfport

On December 29, 2017, while conducting its routine Data Loss Prevention audit, the covered entity (CE) discovered that it inadvertently emailed its internal report to an external email address with an attached spreadsheet and report, due to a clerical error. The email contained names, internal encounter numbers, and medications used during visits to the catheterization and vascular labs from August 17, 2017, through December 28, 2017, for approximately 1,512 individuals. The CE immediately deleted the incorrect email address and sent three test emails to the incorrect email address, but to date has not received a response, including any “undeliverable” recipient responses. To prevent this type of breach from reoccurring, the CE updated its email distribution policy and procedures, instituted monthly meetings with the Outlook email team, and trained the IT department on the new process to add email addresses to distribution groups. The CE provided breach notification to HHS, the affected individuals, and to the media. OCR obtained assurances that the CE implemented the corrective actions listed above.