The covered entity (CE), Jacksonville Spine Center, impermissibly disclosed the protected health information (PHI) of approximately 5,200 individuals when a workforce member misaddressed some envelopes due to a spreadsheet error. The mailing resulted in some individuals receiving correspondence with another patient's name on the envelope. The only PHI involved in the breach was patients' names. The CE provided breach notification to HHS, the media and affected individuals. The notice to individuals requested that patients either return the envelope to the CE or destroy the envelope. As a result of this incident, the CE issued a written warning to the responsible workforce member pursuant to the CE's sanction policy. Moreover, the CE implemented additional safeguards including the checking of data file integrity prior to sending mailings. OCR obtained assurances that the CE implemented the corrective action listed above.
