Illinois Department of Healthcare and Family Services

The Illinois Department of Healthcare and Family Services (IDHFS), the covered entity (CE), reported that a state employee inadvertently changed the addresses of its clients to the incorrect addresses and subsequently mailed protected health information (PHI) to the wrong recipients. This breach affected approximately 4,968 individuals. The PHI involved included names, dates of birth, phone numbers, financial information, and clinical information. The CE notified HHS, affected individuals, and the media. As a result of this breach, IDHFS implemented additional administrative safeguards to prevent incidents of this nature. OCR obtained assurances that the corrective actions noted above were completed.