Lasair Aesthetic Health, P.C.

The covered entity (CE), Lasair Aesthetic Health, P.C., reported that on May 11, 2016, its former employee used her mobile phone to forward 5 emails containing the electronic protected health information of 1,835 patients to her personal email account. The emails consisted of two lists of patients that included names and balances or credit amounts, two emails with pictures that included names of the patients pictured, and one email documenting a patient’s reaction to a medical service. The former employee tendered her resignation on May 10, 2016, and the CE changed all of her passwords within 20 minutes of receiving her notice; however, the breach occurred the next day, because the change in passwords did not update to her mobile phone. The CE provided breach notification to affected individuals, HHS, and the media. Following the breach, the CE created new privacy and security policies and procedures, including a new termination checklist; re-trained its staff; instituted background check procedures for all staff; switched email service to a new provider with increased security controls; and removed remote access capability from the majority of its staff. OCR provided the CE with relevant technical assistance.