The U.S. Postal Service found unsecured printed appointment lists dated October 2017 in the covered entity’s (CE) mail receptacle and returned them to the CE via priority mail package. The protected health information (PHI) involved in the incident included 824 patients’ names, dates of birth, type of appointment, reason for appointment, phone numbers and insurance information. The CE provided breach notification to HHS, affected individuals and the media. Following the breach, the CE developed and implemented new procedures to reduce the need to print and carry PHI between worksites, improved safeguards, executed new business associate agreements with all applicable vendors/contractors, and ensured that staff completed HIPAA training. OCR obtained assurances that the CE implemented the corrective actions listed above.
