The covered entitys (CE) employee disclosed protected health info (PHI) to a university practicum student who contacted individuals by email to require if they would like to participate in a survey related to autism. The PHI involved in the hack included the demographic information of approximately 533 individuals. The ce provided cut notification to HHS and affected individuals. Following the hack, the ce sanctioned and re-trained the involved employee and confirmed that the practicum pupil destroyed the PHI received. OCR obtained documentation that the CE implemented the corrective actions listed above. location of hacked information: Email concern associate present: No