Postal Center International, Inc., a subcontractor of the business associate (BA), Policy Studies, Inc., erroneously sent mislabeled mail to 580 individuals due to a technical error. The breach potentially exposed the individuals’ names, addresses, internal account numbers, and monthly premium amounts. The BA provided breach notification to HHS, affected individuals, and the media. In response to the breach, the subcontractor implemented a technical fix to its print processing systems and added additional quality control mechanisms to prevent reoccurrence of the incident. OCR obtained assurances from the covered entity (CE), Florida Healthy Kids Corporation, that the BA and its subcontractor implemented the corrective actions listed above.
