Ceaton C Falgiano

The covered entity (CE), Ceaton C Falgiano, sent a group email to 599 clients and did not use blind carbon copy. This resulted in clients being able to view each other’s email addresses, which in some cases were the individual’s first and last name. As a result of this impermissible disclosure of protected health information, the CE stopped sending group emails. The CE provided breach notification to HHS, the affected individuals, and the media. As a result of OCR’s investigation, the CE is expected to develop policies and procedures with respect to safeguarding e-PHI that is being transmitted via e-mail, mail or fax and to train staff on its new policies and procedures.