HealthPartners Inc

HealthPartners, which is both a covered entity (CE) and a business associate (BA), reported that on January 21, 2014, it received a call from a person claiming to be the ex-husband of an employee who had devices containing protected health information (PHI). Upon investigating, the CE/BA learned that while teleworking the employee’s husband assisted her with formatting data and creating spreadsheet reports, thus impermissibly disclosing PHI to her husband. The PHI included the demographic and clinical information of 37,606 individuals, as well as health plan and health provider information. The CE/BA provided breach notification to HHS, affected individuals, and the media. To resolve the issues raised in this matter, the CE/BA updated its confidentiality and teleworking policies, trained employees, and incorporated the refresher training into its new employee orientation. Additionally, the CE/BA implemented technical and administrative safeguards related to remote access including encryption software, limiting employees who can write to encrypted removable media, monitoring electronic PHI being transferred to encrypted removable media, and controls to prevent non-company devices from gaining access to the CE/BA’s production network. OCR obtained documented assurances that the CE/BA implemented the corrective actions steps listed above.