Cook County Health (CCH), the covered entity (CE), reported that the protected health information (PHI) of 2,713 individuals was impermissibly sent to its mailing vendor. The PHI involved included names, addresses, and email addresses. The CE notified HHS, affected individuals, and the media. In its mitigation efforts, the CE revised its policies and procedures and trained its staff on privacy protections. OCR obtained assurances that CCH implemented the corrective actions noted.
