The covered entity (CE), CVS Caremark, reported that an employee mailed the electronic protected health information (ePHI) of 3,064 individuals to the wrong recipients. The ePHI involved included names, diagnoses, and health insurance information. The CE notified HHS, affected individuals, and the media. In response to the breach, the CE retrained its staff and implemented additional administrative safeguards.
