American Fidelity Assurance

The covered entity (CE), American Fidelity Assurance Company, erroneously mailed letters to customers containing pages that belonged to another customer due to a mailroom equipment malfunction and manual sorting by an employee. The types of protected health information (PHI) involved in the breach included providers’ names, treatment dates, customers’ names, customers’ employers’ names, and customers’ employer identification numbers. Approximately 2,664 individuals were affected by this incident. The CE provided breach notification to HHS, all potentially affected individuals, and the media. The CE also offered credit monitoring services. The CE retrained staff on safeguarding PHI and verbally reprimanded the employee involved in the incident. As a result of this incident, the CE decided to outsource its mailing and sorting process with a business associate using a fully automated sorting process which provides positive assurance and audit capability. In addition, the CE added quality control measures to their mailing process. OCR obtained assurances that the CE implemented the corrective actions listed above.