Arizona Department of Health Services

On May 26, 2017, the Arizona Department of Health Services, the covered entity (CE) reported that a package of billing documents containing protected health information (PHI) was lost in the mail. The package contained the PHI of approximately 2,500 individuals from its newborn screening program. The types of PHI involved in the breach included names, dates of birth, addresses, phone numbers, health insurance information, and possibly social security numbers. The CE provided breach notification to the affected individuals, the media, and HHS. Following the breach and an investigation, the CE switched the mail carrier it used for shipping its billing information. Pursuant to OCR’s investigation, the CE improved its physical safeguards and implemented new policies and procedures for mailings. OCR obtained assurances from the CE that it has taken the actions above.