Emailed PHI to the Wrong Person: Breach Assessment and Next Steps

It Happens Fast: PHI Sent to the Wrong Email Address

An autocomplete suggestion fills in the wrong name. A medical assistant types a Gmail address instead of a clinic domain. A reply-all sends a patient’s lab results to an entire distribution list. Email misdirection is one of the most common causes of HIPAA breaches reported to OCR each year — and unlike a fax, email can be forwarded, stored, backed up, and indexed across multiple systems in seconds.

If your practice just emailed PHI to the wrong person, this guide covers your immediate obligations, how to assess whether notification is required, and what to do next.

Step 1: Act Immediately to Limit Exposure

Speed matters. Take these steps as soon as you realize the error:

• Attempt to recall the message if your email system supports it (Microsoft Outlook recall works only within the same Exchange organization — it will not recall messages sent to external addresses).
• Contact the unintended recipient. Send a follow-up email or call them directly. Ask them to delete the message and any attachments without reading them, and to confirm deletion in writing.
• Notify your Privacy Officer and open an incident record immediately. Document the exact time of the email, the recipient address, what PHI was included, and what mitigation steps you took.
• Preserve the evidence. Do not delete the sent email from your system — you will need it for your risk assessment and potential OCR documentation.

Step 2: Determine Whether Encryption Changes the Analysis

If the email was encrypted end-to-end and the unintended recipient does not have the decryption key, the PHI may qualify as “secured” under the HHS Breach Notification Rule. Under 45 CFR §164.402, secured PHI — rendered unusable, unreadable, or indecipherable — is not subject to breach notification even if it is disclosed impermissibly.

For email encryption to qualify:

• The message and attachments must have been encrypted using a method consistent with NIST guidance (AES-128 or stronger)
• The recipient must not have access to the decryption key or portal credentials
• TLS-in-transit alone is generally not sufficient — it protects data in transit but not at rest on the recipient’s mail server

If your practice uses a secure email portal that requires the recipient to authenticate before viewing the message, and the wrong recipient never authenticated, you have a strong safe harbor argument. Document the portal access logs showing no authentication occurred.

Step 3: Conduct the Four-Factor Breach Risk Assessment

If encryption safe harbor does not apply, proceed to the four-factor risk assessment required by 45 CFR §164.402:

1. Nature and extent of PHI: What was in the email? A patient name with an appointment reminder carries less risk than an email with diagnoses, SSN, treatment history, or mental health records. Attachments often contain more extensive PHI than the email body.
2. Who received it: Was the unintended recipient another healthcare provider, a known individual, or a completely unknown external address? The identity and obligations of the recipient affect the risk calculation.
3. Whether PHI was acquired or viewed: Did the recipient respond confirming they had not opened it? Do read receipts or portal logs show the email was opened? If the recipient confirmed deletion without reading, this weighs toward low probability of compromise.
4. Mitigation efforts: How quickly did you respond? Did the recipient cooperate? Prompt action and documented cooperation significantly strengthen your position.

Common Scenarios and Their Likely Outcomes

Not every misdirected email results in breach notification. Here are common scenarios and how the risk assessment typically applies:

• Sent to a colleague at the same practice by mistake: The recipient is a workforce member with HIPAA training and access controls. Low risk — typically not a reportable breach, but document the incident and remind staff of minimum necessary principles.
• Sent to the wrong patient: The wrong patient now has another patient’s PHI. This is a disclosure to an unauthorized individual. See our dedicated guide on sending PHI to the wrong patient for specific steps.
• Sent to an unknown external address: Highest risk. You cannot verify whether the email was opened, forwarded, or stored. Notification is likely required.
• Encrypted portal email, recipient never authenticated: Strong safe harbor argument. Document the portal logs and the basis for your determination.

Notification Requirements If a Breach Is Confirmed

If your risk assessment cannot demonstrate a low probability of compromise, you must follow the HIPAA breach notification requirements:

• Individual notification to each affected patient within 60 days of discovery (45 CFR §164.404). The notification must describe what happened, what PHI was involved, what steps the patient should take, and how to contact your practice.
• HHS reporting: Breaches affecting fewer than 500 individuals are reported annually by the end of the calendar year (45 CFR §164.408). Breaches affecting 500 or more require reporting within 60 days.
• State notifications: Many states have independent breach notification laws with shorter timelines. Check your state’s requirements in addition to HIPAA obligations.

Why Email Misdirection Keeps Happening

Most email misdirection incidents share common root causes:

• Autocomplete: Email clients suggest addresses based on history, and similar names lead to wrong selections.
• Reply-all: Staff reply to all recipients instead of the intended individual, expanding the audience for PHI.
• Personal vs. professional accounts: Staff use personal email for convenience, losing both encryption and audit trail protections.
• No verification step: There is no process requiring confirmation of the recipient before sending PHI-containing emails.

Prevention Controls

Reducing email misdirection risk requires both technical controls and workflow changes:

• Mandatory encryption: Require all emails containing PHI to be sent through an encrypted portal or with end-to-end encryption. This alone converts most misdirection incidents from reportable breaches to documented non-events.
• DLP rules: Implement data loss prevention (DLP) policies that flag or block outbound emails containing patterns matching PHI (SSNs, MRNs, diagnostic codes).
• Disable autocomplete for external recipients or require manual confirmation when sending to addresses outside your organization.
• Training: Include email-specific scenarios in your annual HIPAA training. Staff who have practiced identifying a misdirected email are more likely to catch the mistake before clicking send.
• Integrate with your risk program: Include email practices in your security risk assessment and evaluate whether current controls are adequate.

Frequently Asked Questions