Penn State Milton S. Hershey Medical Center

An employee of the covered entity (CE), Penn State Milton S. Hershey Medical Center, downloaded protected health information (PHI) onto an unsecured flash drive and used the device in his personal computer to complete work which he then emailed to the CE using his personal email account. The types of PHI involved in the breach included the demographic and clinical information for 1,801 individuals. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE performed a risk assessment and updated encryption measures. The CE also reminded all clinical laboratory staff and faculty of expected practices pertaining to safeguarding PHI, and provided staff a listing of the relevant policies concerning encryption and electronic messaging and links to the corresponding policies. As a result of OCR's investigation, the CE submitted to OCR copies of its policies regarding use of personal devices and emails, storing PHI on third party owned or managed media and use of approved electronic connections, systems and/or services. OCR verified that appropriate policy was in place at the time of the incident and the employee did not follow the policy. OCR obtained assurances that the CE has implemented the corrective actions listed above.