On June 5, 2018, Kaiser Foundation Health Plan of Colorado, the covered entity (CE), discovered that due to an employee error in performing a mail merge, approximately 900 members’ names were mismatched with other members' addresses. The types of protected health information (PHI) involved in the incident included members' names and the names of their former primary care physicians. The CE provided breach notification to affected individuals, the media, and HHS. Following the breach, the CE revised its mailing processes. OCR obtained assurances that the CE implemented the voluntary corrective actions listed above. The employee responsible for the breach is no longer employed with the CE.
