Holy Cross Hospital

A covered entity's (CE) employee impermissibly obtained copies of patient data sheets containing protected health information (PHI) and sold the PHI to a third party. The PHI included names, addresses, dates of birth, social security numbers, insurance information, and diagnoses affecting 38 individuals; however, the initial investigation addressed a report of approximately 1,500 affected individuals. The CE provided breach notification to 44,000 individuals (including those who were potentially affected), HHS and the media. In addition, free credit monitoring was offered. Following the breach, the CE cooperated with federal authorities, law enforcement, and the state health administration agency, and provided a report to a national accreditation organization. As a result of this incident, the CE convened a high level work group to oversee privacy and security issues and hired an expert forensic investigator to perform a risk assessment. The CE updated its privacy and security policies and procedures, developed a plan to adopt electronic health records and initiated a continuous review process including random HIPAA compliance audits. The CE also expanded its HIPAA training program for employees. OCR obtained written assurances that the CE implemented the corrective action listed above.