D190 Task 1 Privacy Breach Response Plan Example

Sixty-Four Addresses in the CC Line: Determining the Scope of and Responding to a Misdirected Group Email at a Composite Outpatient Recovery Clinic

Student Name

Leavitt School of Health, Western Governors University

D190: Introduction to Healthcare IT Systems, Task 1

Course Instructor

Month Day, Year

Sixty-Four Addresses in the CC Line: Determining the Scope of and Responding to a Misdirected Group Email at a Composite Outpatient Recovery Clinic

The Incident

Clearwater Behavioral Health is a composite outpatient clinic that provides counseling and medication treatment for opioid use disorder. It runs a weekly family recovery support group. On a Tuesday afternoon, the peer support coordinator sent a reminder that the group would meet in a different room. The subject line read "Opioid Recovery Family Group moved to Room B," and the coordinator entered all 64 recipients in the CC field rather than the BCC field. Every recipient could therefore see every other recipient's email address, and many addresses contain full names. Within an hour, one recipient replied to all asking to be removed from the list. The next morning a patient called the clinic manager, upset that her neighbor now knew she was in treatment. The manager notified the privacy officer, who opened an incident file.

Why This Involves Protected Health Information

An email address alone is not usually health information. Here, however, each address appears in a message whose subject line and sender identify it as belonging to a participant in an opioid recovery group at a treatment clinic. Linking an individual's identity to the fact that they or their family member receives substance use disorder treatment makes the disclosure protected health information under HIPAA. It also involves records protected by 42 CFR Part 2, the federal rule that gives substance use disorder treatment records stronger confidentiality protection, because the clinic is a federally assisted treatment program and the email reveals that specific people are in its program.

Determining the Scope

Before deciding whether the incident is a reportable breach, the privacy officer must establish exactly what was disclosed, to whom and how far it may have spread. The plan uses six steps.

First, preserve the evidence. The sent message, the recipient list and the reply-all message are saved to the incident file, and the email administrator exports the message logs before automatic deletion. Second, classify every recipient. The HIM department matches each address to the clinic's records to determine how many belong to current or former patients, how many to family members, and whether any address was entered incorrectly and belongs to someone with no connection to the clinic. The match found 41 patients and 23 family members; one patient's address had been mistyped and delivered the message to an unknown external account. Third, determine what each recipient saw: the names and addresses of all 64 recipients and the subject line linking them to opioid treatment. No clinical notes or attachments were included. Fourth, check for further spread by asking the email administrator whether the message was forwarded from within the clinic's system and by reviewing replies. Fifth, check whether this was an isolated event by auditing the coordinator's sent messages for the past 90 days; two earlier reminders had been sent correctly with BCC. Sixth, interview the coordinator to understand how the error occurred.

Risk Assessment

Under the HIPAA Breach Notification Rule, an impermissible use or disclosure of protected health information counts as a breach by default; the organization can rebut that presumption only by documenting a risk assessment concluding that the chance of compromise is low. HHS lists at least four factors that such an assessment has to weigh (U.S. Department of Health and Human Services [HHS], n.d.).

What the information was and how much of it: names and email addresses linked to opioid use disorder treatment. Although no clinical detail was disclosed, the fact of treatment is among the most sensitive information a person has, with risks to employment, relationships and legal matters. The unauthorized recipients: other patients and family members, who are not covered entities and have no legal duty to keep the information confidential, plus one unknown external account. Whether anyone in fact opened and read it: yes, as shown by the reply-all message and the patient's call about her neighbor. The extent of mitigation: the clinic can ask recipients to delete the message, but it cannot confirm deletion or prevent recipients from remembering what they saw.

Taken together, the factors do not support a finding of low probability of compromise. The incident is a reportable breach.

Notification

Individuals. The 41 patients whose participation was disclosed must be told in writing, promptly and never more than 60 days after the clinic learned of the breach (HHS, n.d.). The clinic will send letters by first-class mail within 10 days. Each letter will describe what happened in plain language, what information was involved, what the clinic is doing and what the individual can do, and will give a contact for questions. Because the family members' addresses also revealed that a relative is in treatment, the letters will go to each affected patient, and the clinic will contact family members through the patient's preferred method rather than by email.

HHS. Because fewer than 500 individuals were affected, the clinic will record the incident in its breach log and file it with HHS through the online breach portal within 60 days after the calendar year ends. A breach affecting 500 or more residents of a state would also require notice to prominent media outlets, which does not apply here.

Part 2 and state law. A 2024 final rule revising 42 CFR Part 2 applied the HIPAA breach notification requirements to breaches of Part 2 records, aligning the two rules (HHS, 2024). The clinic's privacy officer will also check the state's breach notification and health privacy laws, which may set shorter deadlines or require notice to the state attorney general.

Corrective Actions

Correcting the cause matters more than correcting the coordinator. The clinic will stop using ordinary email for group communications and move reminders to the patient portal or a messaging tool that sends each message individually. The email system will be configured to warn any sender who places more than five external addresses in the To or CC fields. Subject lines for patient communications will be neutral, such as "Thursday group update," so that no message reveals treatment in its first line. All staff will complete training on privacy for substance use disorder records within 30 days. Training is needed across the organization, not only for one employee: in focus groups with behavioral health providers from treatment organizations in 14 states, confusion about the rules for releasing substance use disorder information under HIPAA, Part 2 and state law was widespread (Kaiser et al., 2026). The coordinator will be counseled under the clinic's sanctions policy, which treats an unintentional first error differently from a deliberate disclosure. Finally, the privacy officer will audit group communications monthly for six months and report results to the compliance committee.

Conclusion

A single wrong field in an email turned a room change into a breach of highly sensitive information. By first determining scope with evidence, then applying the four-factor risk assessment, the clinic reached a defensible decision to notify, met its deadlines under HIPAA and Part 2, and changed the tools and habits that made the error possible.

References

Kaiser, M., Wei, M., Nookala, S. P., Cooper, R., Ariosto, D., Adams, C., Grando, A., Sadeghi, M., & Murcko, A. C. (2026). Beyond fax: Provider perspectives on data sharing in substance use disorder care. JAMIA Open, 9(4), ooag162. https://doi.org/10.1093/jamiaopen/ooag162

U.S. Department of Health and Human Services. (2024). Fact sheet 42 CFR Part 2 final rule. https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html

U.S. Department of Health and Human Services. (n.d.). Breach notification rule. Retrieved September 29, 2026, from https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html