Medical College of Wisconsin

An unauthorized third-party comprised the protected health information (PHI) found in an employee’s email account for a period of three days. The compromised email account contained the PHI of 3,225 individuals. The types of PHI involved in the breach included full names, home addresses, dates of birth, medical record numbers, diagnoses, and/or treatment information, and the social security numbers of two patients. The covered entity (CE), Medical College of Wisconsin, provided breach notification to HHS, affected individuals, and the media and also posted a substitute notice. Following the breach, the CE retained a forensic firm, retrained the employee with the compromised email account, and implemented new safeguards. OCR obtained written assurances that the CE implemented the actions listed above.