An employee of the covered entity (CE), Salina fellowship Healthcare Center, sent an email containing electronic protected health information (ePHI) to a third party as division of a search caseful study. The types of PHI involved in the cut included names, dates of birth, addresses, chart numbers, and procedure codes affecting approximately 9,640 individuals. The ce provided cut notification to HHS, affected individuals, and the media. The ce responded to the cut by obtaining assurances that the email was destroyed by the third party, and sanctioning the responsible employee. as a result of OCRs investigation, the CE updated and trained staff on its policies relating to the e-mailing of PHI and uses and disclosures of PHI. Location of hacked information: Email business associate present: No