GEO Care, LLC

The FBI notified the covered entity (CE), GEO Care, that a GEO Care employee, inappropriately accessed the patient admission reports of approximately 710 patients at South Florida State Hospital and provided them to a third party, the employee's cousin, without authorization. The employee's cousin then attempted to sell the reports for an illegal purpose. The protected health information (PHI) involved in the breach included names, dates of birth, social security numbers, admission dates, discharge dates, and patients' unit names. The CE provided breach notification to HHS, the media, and posted substitute notice on its website. It also offered identity theft protection to the affected individuals. The responsible staff member was terminated according to the CE's policy and has also been criminally indicted. Following the breach, the CE improved safeguards by limiting the use of full social security numbers, restricting access to documents, and performing weekly audits of those workforce members who access documents with full social security numbers. Additionally, the CE updated its privacy and security policies and procedures and developed new policies and procedures. It also revised its policies for employee access to electronic PHI based on job title and function, and provided retraining to employees regarding access and disclosure of PHI. OCR obtained assurances that the corrective actions listed above were completed.