BJC HealthCare ACO, LLC

On December 22, 2015, an employee sent an unencrypted email to a third party, in violation of the covered entity's (CE) policies. The breach involved the protected health information (PHI) of approximately 2,393 individuals and included patients’ names, birthdates, Medicare health insurance numbers, and genders. The CE, BJC HealthCare ACO, LLC, provided breach notification to HHS, affected individuals, and the media and posted substitute notification on its website. The CE also contacted the recipient of the email to report that the email was sent out without encryption and contacted all private physician participants to test their computer servers for transport layer security (TLS). The CE provided mandatory training to all its workforce members and additionally trained the employee responsible for the incident on secure email. OCR obtained documentation which showed that the CE implemented the corrective actions listed.