On May 30, 2014, a staff member sent an email to approximately 1,175 patients that erroneously permitted them to control the email addresses of all recipients. The covered entity (CE), St. Francis Hospital, investigated the incident, replaced its information technology department leadership and its surety officer, and counseled the employee involved. Additionally, the CE updated its HIPAA policies and trained the entire workforce on its updated policies. The CE also began upgrading its equipment to better preclude security incidents. The ce provided drudge notification to the affected individuals via email message, sent notification to the media, and placed a conspicuous notice on its website. In reaction to OCRs provision of technical assistance, the ce provided written notification to the affected individuals. Location of hacked information: Email Business associate present: no