Washington State Health Care Authority (HCA)

A workforce member impermissibly emailed the protected health information (PHI) of 141,288 individuals to an unauthorized personal email account that belonged to another state employee related to the workforce member. The types of PHI involved in the breach included addresses, dates of birth, names, other identifiers, social security numbers, diagnoses, and other treatment information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the covered entity (CE), Washington State Health Care Authority, updated all relevant policies and procedures, implemented additional security measures, and retrained employees. The CE updated its access management program and hired new staff to focus solely on managing access to electronic systems. It also sanctioned the employee involved in the breach. OCR obtained written assurances that the CE implemented the corrective actions listed above.