Mo. Dept. of Mental Health

The covered entity, Missouri Department of Mental Health reported that the PHI of 5,685 individuals was compromised when a business associate (BA), Burrell Behavioral Health, reported that an unauthorized individual(s) accessed the email account of an employee which contained PHI from the covered entity. The employee sent thirteen (13) personal emails to the account of a third party. The email account which was impermissibly accessed contained electronic protected health information (ePHI) for approximately 7,748 patients. The ePHI included names, treatment, social security numbers, and financial information. The covered entity provided breach notification to HHS, affected individuals, and the media, and posted notice on its website. The business associate directed a third-party forensic information technology investigator to determine the cause and severity of the breach. The investigation concluded that the breach was limited to one employee’s email account. The business associate disabled email internet access globally for all employees. The business associate also sent out educational documents and reminders to all employees about password security and best practices for HIPAA and network security. The business associate also provided one year of identity and credit protection to affected individuals. OCR obtained assurances that the business associate took the voluntary corrective actions described above. During the investigation of the covered entity, OCR reviewed the business associate agreement. The BA review resolved additional issues raised by the breach, and this case was closed after the BA agreement was determined to conform to HIPAA requirements.