Project Belle, LLCNH · Healthcare Provider · 840 individuals · submitted Sep 17, 2026
Unauthorized Access/DisclosureEmail
What changed afterward
- In response to the breach, the CE implemented additional administrative, technical, and security safeguards to better protect its PHI.
Program action
Put phishing-resistant MFA on every mailbox, filter inbound mail, and cut the ePHI kept in mailboxes with retention rules.
HIPAA §164.312(d), 164.308(a)(5)(ii)(A)
CISSP 5CISM 3CISA 5
Full OCR narrative
The covered entity (CE), Project Belle, LLC, reported that an employee emailed files containing protected health information (PHI) of 840 individuals from a work email account to the employee’s personal email account without approval or authorization. The PHI involved clinical and demographic information. The CE notified HHS, the affected individuals, and the media. In response to the breach, the CE implemented additional administrative, technical, and security safeguards to better protect its PHI.