Cook County Health & Hospitals System

The covered entity (CE), Cook County Health and Hospital Systems, reported that on November 12, 2013, as part of a public health project between the CE and another academic medical center, a physician at the CE sent an unencrypted email with an excel attachment to a collaborator outside the CE’s firewall. The attachment contained the protected health information (PHI) of 22,511 individuals. The attachment was not encrypted as required by organizational policy. The types of PHI involved in the breach included demographic information and lab results. The CE provided breach notification to HHS, affected individuals, and the media. The CE disciplined the employee with a 14 day suspension, implemented a new email security program, and retrained its employees and staff on the program. OCR obtained documentation from the CE that it implemented the corrective actions listed above.