Birmingham Printing and Publishing

On September 6, 2013, the covered entity (CE), discovered that its business associate (BA) had mislabeled invitations for an event for cancer survivor patients. While the address was correct, the name on the envelope was incorrect for 1,085 individuals. The BA re-sent the invitations to the correct names and addresses with a letter explaining the mistake to the affected individuals. In response to the breach, the CE terminated its business relationship with the BA and changed to processing bulk mailings in-house. Although the CE had a policy in place before the breach that clearly outlined breach notification requirements, the CE did not perform media notification after this breach. OCR provided technical assistance on this topic. In addition, OCR obtained assurances that the CE implemented the corrective actions listed above.