CaroMont Medical Group

On August 8, 2013, the covered entity (CE), CaroMont Medical Group, performed an internal audit that found an unencrypted email was sent by an employee on August 5, 2013. The employee emailed a spreadsheet to her personal email containing the following protected health information (PHI) for 1,310 individuals: patients’ names, dates of birth, medical record numbers, insurance providers, insurance numbers, diagnoses, and two Medicaid/Medicare numbers. The CE provided breach notification to HHS, affected individuals, and the media. In response to this incident, the CE reviewed its policies, updated its secure email policy, and required employees to attest to reviewing the new policy. The CE trained staff on data privacy and information security, and it implemented security controls for the encryption of all external emails containing an attachment. OCR obtained assurances that the CE implemented the corrective actions noted above.