Medical Center Ophthalmology Associates

A workforce member of the covered Entity (CE), Medical Center Ophthalmology Associates, sent a mass email to patients, in lieu of using its patient portal, and accidentally disclosed the patients’ email addresses in the “Cc” field instead of the “Bcc” field. The protected health information involved included the email addresses of approximately 3,017 individuals. The CE provided breach notification to HHS, affected individuals, and the media. Following this breach, the CE sanctioned the involved workforce member and retrained employees. OCR confirmed the CE had policies and procedures in place prior to the breach and obtained assurances that the CE implemented the corrective actions listed above.