Cheasapeake Regional Information System for our Patients, Inc. (CRISP)

CRISP, a Maryland-based health information exchange acting as a business associate, reported that an employee made the protected health information of 8,008 individuals — including diagnoses, medications, claims, and other treatment information — viewable by unauthorized individuals. The BA notified HHS and affected individuals, implemented additional technical safeguards, and retrained staff.

Affected (this filing): 8,008