The covered entity (CE) erroneously sent mailings to the wrong patients due to a formatting error occurred in a spreadsheet,, affecting approximately 4, 586 individuals. The protected health information (PHI) involved in the breach included patients' names. The CE provided breach notification to HHS and affected individuals. Following the breach, the CE created quality assurance procedures for patient mailings and trained its workforce on the new procedures. The CE sanctioned the employee responsible for the incident by providing counseling and training on the new procedures. Since the number of affected individuals in each state did not reach over 500 individuals, the CE did not provide media notice. OCR obtained documented assurances that the CE implemented the above-mentioned corrective actions.
