Holy Cross Hospital, Inc.

Holy Cross Hospital (FL) reported to HHS OCR on 2010-11-16 a Theft/insider incident affecting 1,500 individuals (notification sent to ~44,000 potentially affected). A hospital employee impermissibly copied patient data sheets containing PHI — including names, addresses, dates of birth, SSNs, insurance information, and diagnoses — and sold the information to a third party. Confirmed PHI of 38 individuals was sold; ~1,500 were initially identified as at risk. The CE cooperated with federal and state authorities, offered free credit monitoring, and implemented extensive corrective actions under OCR oversight.

Affected (this filing): 1,500