JASACare

Unauthorized individuals hacked a workforce member’s email account and accessed the electronic protected health information (ePHI) of 1,154 patients. The types of ePHI involved in the breach included names, addresses, phone numbers, dates of birth, social security numbers, insurance identification numbers, insurance information, and account balance information. The covered entity (CE), JASACare, provided breach notification to HHS, affected individuals, and the media and posted substitute notice on its website. The CE also provided one year free credit monitoring services for the affected individuals. Following the breach, the CE shut down the workforce member’s email account and reset all login information. As a result of OCR’s investigation and technical assistance, the CE developed new policies regarding emailing ePHI and distributed them to its workforce members. The CE is expected to perform a thorough and accurate risk analysis and establish a risk management plan. It is also expected to implement mechanisms to record and examine activity in information systems that contain or use ePHI. Additionally, the CE is expected to implement technical security measures to guard against unauthorized access to ePHI, implement procedures for identity verification for access to ePHI, and provide training to all staff on the newly implemented policies and procedures.