Preventice Services

A business associate (BA), Zirmed, Inc., erroneously mailed notices that contained other patients’ names and dates of services due to a programming error by its sub-contractor, Allison Payment Systems (APS). The breach affected approximately 6,800 individuals. The CE initially provided breach notification to HHS and affected individuals. Following the breach, the covered entity (CE), Preventice Services, LLC, worked with the BA and its sub-contractor to correct the programming error and add an additional technical safeguard. OCR confirmed that appropriate BA agreements were in place prior to the breach, provided technical assistance regarding media notification requirements, and confirmed that the CE completed the required breach notifications, including the posting of substitute notice on its website.