- State
- MD
- Covered entity type
- Healthcare Provider
- Individuals affected
- 907
- Business associate present
- No
- Type of breach
- Unauthorized Access/Disclosure
- Location of breached information
- First seen by InfoSec Signals
- 9/23/2026
- Last seen in OCR export
- 9/23/2026
OCR description
A Cardiology Associates’ employee mailed patients’ protected health information (PHI) to her personal email address without a legitimate business purpose. The breach included the PHI of 907 individuals and included names, dates of birth, and social security numbers. Following the breach, the covered entity (CE) sanctioned the employee, which included termination in this case, and notified the Federal Bureau of Investigation. OCR reviewed the CE's risk assessment to ensure compliance with the Security Rule.
Change history
- 9/23/2026Added to OCR's archive list
Source: HHS OCR Breach Portal, U.S. Department of Health and Human Services, Office for Civil Rights about this source
Records are reproduced as published; entity names and figures are OCR's.