Health Care Solutions at Home

The covered entity (CE) mistakenly mailed protected health information (PHI) to the wrong addresses of approximately 1,139 individuals following a computer error at the business associate (BA). The PHI involved in the breach included names, addresses, dates of birth, dates of service, claims information, and diagnoses. The CE provided breach notification to affected individuals, HHS, and the media, and posted substitute notice on its website. To prevent a similar breach from happening in the future, the CE and BA improved safeguards by updating policies to require multiple reviews of PHI in mailings. Following OCR's investigation, the CE updated its policies and procedures relating to the minimum necessary standard.