Email blooper exposes PHI

An unfortunate mistake resulted in a group of medical center students receiving an email attachment listing protected health information on all 2,281 students.

The University of Mississippi Medical Center (UMMC) will notify those medical center students that their protected information on them was inadvertently sent to 190 other students.

The 190 students were being informed via email of health facilities that accept their student health insurance plan. But, the emails included a spreadsheet attachment that listed the name, date of birth, Social Security number, ethnic origin, address, insurance information, grade point average, credit hours earned, tuition and account balances of the 2,281 medical center students, according to a statement from the medical center.

The mistake was discovered and the medical center began retracting the emails 50 minutes after they were sent on August 21. A total of 115 students opened the email and an unknown number opened the attachment. “Upon discovery of the error, the Department of Information Systems was promptly notified and appropriate actions were taken to delete the email and attached file from all recipients’ accounts,” according to an email sent to the 2,281 affected students on August 23. “The individuals who opened the email and attachment have been advised about their responsibilities under UMMC’s information security policies.”