BeneSys, Inc.

BeneSys, the business associate (BA), reported that an employee inadvertently emailed documents containing the electronic protected health information (ePHI) of 1,070 individuals to the wrong recipient. The ePHI involved included names, Social Security numbers, and financial information. The BA notified HHS, affected individuals, and provided complimentary credit monitoring services to those affected by the breach. In its mitigation efforts, the BA sanctioned the responsible employee, implemented additional administrative safeguards, and retrained its staff. OCR obtained assurances that the BA implemented the corrective actions noted.