Ohio Department of Mental Health and Addiction Services

The covered entity (CE), Ohio Department of Mental Health and Addiction Services, reported that postcards containing protected health information (PHI) were mailed to patients and/or their families. The PHI involved included names, addresses, and treatment information. The postcards were mailed to approximately 54,000 individuals. The CE notified HHS, affected individuals, and the media. As a result of this breach, the CE halted further mailings of postcards containing sensitive information. The CE also adopted additional administrative safeguards to further protect its PHI and retrained its staff. OCR obtained assurances that the CE implemented the corrective actions noted.