Anne Arundel Health System

Anne Arundel Health System, the covered entity (CE), reported that it inadvertently mailed 2,208 letters containing protected health information (PHI) to the wrong recipients. The PHI involved included names, addresses, diagnoses, clinical information, and other treatment information. The CE notified HHS, affected individuals, the media, and provided complimentary credit monitoring services. In its mitigation efforts, the CE sanctioned the responsible employees, implemented additional administrative safeguards, and retrained it staff. OCR obtained assurances that the CE implemented the corrective actions noted.