Indian Health Service, Aberdeen Area Office

The Indian Health Service (IHS) reported than an employee of its business associate (BA), was observed copying and pasting medical records and then sending those documents to his personal email account. The protected health information (PHI) involved included names, social security numbers, dates of birth, and other demographic information. This breach incident affected 1,720 patients and occurred between March 1, 2013 and August 25, 2014. Upon learning of the physician’s actions, IHS immediately terminated his contract, notified all affected individuals and the media, and obtained written assurance from the physician that he deleted all of the medical records from his personal computer. As a result of OCR’s investigation and technical assistance, IHS developed policies and procedures for safeguarding PHI.