Martinsburg VA Medical Center

On February 13, 2019, a misalignment of a printing process by a business associate (BA), Xerox, caused patient laboratory results to be mailed to the wrong patients, affecting 4,882 individuals’ demographic and clinical information. Following the breach, the BA and CE agreed on a their respective responsibilities, and the BA implemented a detailed quality control process for each level of the print operation. The CE reviewed its most recent risk assessment and updated it accordingly. OCR reviewed the breach notification provided to the affected individuals, as well as the security measures implemented to address risks and vulnerabilities. OCR obtained assurances that the CE implemented the corrective actions listed.