The covered entity (CE), Affinity Health Plan, Inc., mistakenly sent renewal letters to members that contained a different member’s name and address and their children’s names and identification numbers and coverage information. The breach affected 497 heads of household and 224 children. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE placed a hold on outgoing bulk mailings. As a result of OCR’s investigation, the CE reviewed and revised the organization’s mailing procedures to ensure that they comply with minimum necessary standards, and quality standards. The CE also retrained all staff on its updated policies and procedures and on HIPAA safeguards for members’ PHI. OCR obtained assurance that the CE implemented the corrective actions noted above.
