Area Agency of Aging 1-B

A workforce member failed to encrypt emails containing spreadsheet attachments when they were sent to the intended recipient. The unencrypted emails contained the protected health information (PHI) of approximately 1,741 individuals and included names, case numbers, dates of service, and medical procedures codes. The covered entity (CE), Michigan Department of Health and Human Services/Aging and Adult Services Agency, provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE ensured that staff completed mandatory agency-wide HIPAA training. It also followed up with the involved staff. The person responsible for the unencrypted emails is no longer working with the agency. The CE improved technical safeguards to encrypt all outgoing emails and attachments. Finally, the CE initiated a review and update of its HIPAA policies and procedures. OCR obtained documented assurances that the CE implemented the corrective actions noted above.