EnvisionRx

Due to a processing error, the business associate (BA), EnvisionRx, mailed letters to the covered entity’s (CE) members that contained other members' protected health information (PHI). The names, medications, and dates of service of 540 individuals were involved in the breach. The BA provided breach notification to HHS, affected individuals, and the media. The BA responded to the breach by implementing additional quality control procedures, updating its Breach Rule Notification policy, and training the appropriate staff. As a result of OCR’s investigation the BA updated it BA agreement with the CE, Orange-Ulster School District Health Plan. The BA also provided OCR with documentation of its corrective actions.