University Hospitals Rainbow Babies and Children’s Hospital has confirmed that an employee sent a group of patients an email that included “personally identifiable information.”
“The email contained information related to a new departmental billing policy,” according to a news release from the hospital. “While the email message itself did not contain any specific health information about any patient, the nature of the message implied all recipients receiving the message shared the same medical condition. UH has mailed letters to notify each individual who may have been affected.”
In all, 847 emails were included in the group message, according to a UH spokesman.
Rather than entering the emails in the blind copy field, recipients’ emails were placed in the “To” field in the Feb. 28 email, according to UH. The unauthorized disclosure has since been investigated, and UH has “educated the employee regarding the proper procedure when communicating with patients electronically.”
The hospital said it has notified the appropriate regulatory bodies and those “whose information was part of the incident.” UH also plans to provide additional training and tools for staff who need to communicate digitally with patients.