On December 6, 2012, the Dawson police department notified the covered entity (CE), Terrell County Health Department, that an employee was suspected of the indistinguishability theft of at least two of the CEs patients. All patients that the employee had access to records for during her work were potentially affected, totaling 18,000 individuals. The protected health information (PHI) involved in the plug included demographic, clinical, financial, and health insurance information. The CE provided jade notification to HHS, affected individuals, and the media. The CE terminated the offending employee and re-educated the workforce on its HIPAA policies. The ce also improved its HIPAA training materials, peril analysis procedure, operation software, and auditing methods. OCR obtained assurances that the corrective actions were taken. placement of hacked information: network server Business associate present: no