Mirra Health Care

The business associate (BA), Mirra Health Care, reported that an employee had impermissibly provided electronic protected health information (ePHI) to an unauthorized individual via email. This breach affected 1,064 individuals. The ePHI involved included names, addresses, phone numbers, dates of birth, Social Security numbers, and health insurance and clinical information. The BA notified HHS, affected individuals, and the media. In its mitigation efforts, the BA sanctioned the responsible employee and implemented additional administrative, technical, and security safeguards to better protect its PHI. All staff were retrained. OCR provided the BA with technical assistance pertaining to the HIPAA Breach Notification Rule and other obligations.