Alicia Ann Oswald

On January 9, 2018, the covered entity (CE), Dr. Alicia Oswald, reported that she sent group emails to her patients without using the “blank carbon copy” (BCC) feature to mask the recipients. The breach affected an estimated 800 individuals’ email addresses. In response to the breach, the CE re-sent the email using BCC and apologized to the individuals, reported the incident to the California State Board, and provided breach notification to HHS. The CE adopted improved email software to prevent a similar incident from happening in the future and deployed practice software to safeguard protected health information. OCR obtained additional documentation including the CE’s HIPAA Notice of Privacy Practices Policy. OCR obtained assurances that the CE implemented the corrective actions listed above and provided technical assistance regarding the requirements of the HIPAA Breach Notification Rule.