Hospice of the Chesapeake, Inc.

An employee of Hospice of the Chesapeake, contrary to CE policy, emailed spreadsheets containing ePHI of 7,035 patients to a personal email account; a third party may have viewed them. A subsequent forensic investigation found an additional spreadsheet with PHI of 571 more patients in the employee's personal email account, bringing the total to 7,606. PHI exposed included names, addresses, conditions, and diagnoses. The CE notified affected individuals, the media, and HHS, posted substitute notice, sanctioned and terminated the employee, and provided assurances to OCR of periodic risk assessments.