OrthoTexas Physicians and Surgeons

On or around October 5, 2018, a business associate (BA) mismatched letters and envelopes in a mailing intended for patients of the covered entity (CE), resulting in access by unauthorized persons. The letters contained the protected health information (PHI) of 2,172 individuals, specifically, patients’ names and addresses. The CE provided breach notification to HHS, affected individuals, and the media. As a result of the breach, the CE modified its mass-mailing policies and procedures to stop including PHI in announcement letters to patients, implemented new approval standards, and trained its workforce members on the modified policies and procedures. OCR obtained assurances that the CE implemented the corrective actions described above.