Mary Ruth Buchness, MD, Dermatologist, P.C.

The covered entity, Mary Ruth Buchness, MD, Dermatologist, P.C., reported that a workforce member sent an email with an Excel spreadsheet attachment that contained 14,910 patients’ protected health information to patients not intended to receive the attachment. The Excel spreadsheet included patients’ names, Social Security Numbers, dates of birth, gender, dates of last service and next appointment, telephone numbers, addresses, email addresses, marital status, head of household, employer/occupation and race/ethnicity. The covered entity provided breach notification to HHS, the media, and the affected individuals (including the offer of 12 months of credit monitoring and identity protection services at no cost to the affected individuals), and posted a notice to its website. Following the breach, the covered entity updated its HIPAA policies and procedures to prohibit sending an email to multiple recipients, and provided HIPAA training to its workforce. OCR obtained assurances that the covered entity implemented the corrective actions listed. OCR advised the covered entity that it is expected to conduct a risk analysis, implement a corresponding remediation plan, and sanction the workforce member responsible for the breach incident.