University of Pittsburgh Medical Center, St. Margaret Hospital (“UPMC St. Margaret”)

The covered entity (CE), UPMC St. Margaret, reported that an employee impermissibly emailed the electronic protected health information (ePHI) of approximately 11,135 individuals to his personal email account and to another employee. The ePHI involved included names, and medication information. The CE notified HHS, affected individuals, the media, the FBI, and posted substitute notice on its website. Following the breach, the CE sanctioned the employee and implemented additional administrative, technical, and security safeguards to better protect its PHI.