Orange County Global Medical Center

On February 8, 2017, a workforce member of the covered entity (CE), Orange County Global Medical Center, inadvertently sent two medical statistical reports on C-Sections and vaginal births to an unauthorized recipient. The reports contained one or more of the following types of protected health information (PHI) about 677 of the CE's patients: treatment and diagnostic information, medical record numbers, dates of birth of infants, treating staff names, and treatment dates. The CE reached out to the unauthorized recipient and asked that the information be destroyed and deleted from his/her e-mail. The CE provided breach notification to HHS, affected individuals, and the media. OCR obtained assurances that the CE implemented the corrective actions noted above and indicated that the CE is expected to complete an enterprise-wide security risk analysis as a result of this incident.