North Carolina Department of Health and Human Services

The covered entity (CE), the North Carolina Department of Health and Human Services, reported that an employee sent an unencrypted email that contained the electronic protected health information (ePHI) of 1,615 individuals to an unauthorized recipient. The ePHI involved included names and claims and treatment information. The CE notified HHS, affected individuals, and the media. In its mitigation efforts, the CE sanctioned the responsible individual and implemented additional security safeguards to better protect its ePHI.