Highland Rivers Community Service Board

A staff member of Highland Rivers Community Service Board, the covered entity (CE), sent incorrect information to the CE’s billing agent. Relying on the incorrect information, the billing agent mailed statements to 967 individuals, some of which contained protected health information (PHI) for the wrong patients. The statements contained the individual’s name, account number, dates of service, fess for service, and cumulative balance. Following the incident, the CE sanctioned the staff member involved, provided HIPAA retraining, and reviewed its policies and procedures. As a result of OCR’s investigation, the CE created a new, more secure written procedure for sharing PHI with vendors. The CE also provided breach notification to HHS, the affected individuals, and the media. Further, in response to technical assistance provided by OCR, the CE provided substitute notice on its website and in person, when individuals next visited the CE for services.