SIDNEY HEALTH CENTER

Sidney Health Center notified patients of two incidents in late 2024. First, a physician saved patient PHI (names, DOB, medical history) to a personal Google account (insider misuse). Second, an employee's email was accessed by an unauthorized person, exposing limited treatment info. The physician resigned; the email attacker was unauthorized. No SSN or financial data was involved.

Sidney Health Center (MT) reported to HHS on 2025-01-03 an Unauthorized Access/Disclosure affecting 1,370 individuals. An employee impermissibly saved PHI — including names, birthdates, addresses, medications, and other treatment information — to a personal Google account. Breached information was located in Email/cloud storage. The CE sanctioned the responsible employee and implemented additional technical safeguards, and notified HHS, affected individuals, and media.