Missouri Dept. of Mental Health

The covered entity (CE), Missouri Dept. of Mental Health, erroneously mailed letters to family members of individuals receiving services, affecting 1,000 individuals. The protected health information (PHI) involved in the breach included consumers' names. Following the breach, the CE implemented additional safeguarding and quality control procedures for mailings. The CE provided notice of the breach to affected individuals, the media, and to HHS. As a result of OCR’s investigation, the CE updated its Breach Rule Notification policy, specifically to include information about reporting breaches that affected under 500 individuals. OCR obtained documented assurances that the CE implemented the corrective actions listed above.