CDC/NIOSH/ World Trade Center Health Program

The covered entity (CE), CDC/NIOSH/World Trade Center Health Program, discovered that mail sent via the U.S. Postal Service (USPS) containing protected health information (PHI) was damaged en route to the recipient and some of the pages were missing upon receipt. The missing documents contained the names, provider names and numbers, medical codes, dates of service, and the treatment information for 597 individuals. The CE provided breach notification to HHS, affected individuals, and substitute notice on its website. The CE also set up a toll free telephone number to answer questions. Notification to a prominent media outlet was not required as the breach did not affect 500 or more individuals residing in the same region. In response to the breach, the CE requested that the USPS conduct a Mail Recovery Search to locate the lost and/or unidentifiable pages, but the missing documents were not found. OCR obtained assurances that the CE implemented the corrective actions listed above.