SAGE DENTAL MANAGEMENT

Sage Business Management, LLC, a business associate (BA) of the covered entity (CE), Sage Dental Group of Florida, PLLC, reported that mail including protected health information (PHI) was stolen from a USPS mailbox it shared with other businesses. The PHI included 5,539 individuals’ full names, dates of birth, home addresses, telephone numbers, dental insurance information, Sage Dental account numbers, diagnoses, and types of dental treatment. OCR confirmed that checks from insurance carriers were stolen from the mailbox and fraudulently cashed. In response to the incident and OCR’s investigation, the BA arranged to restrict delivery of mail on weekends and changed its claims submission and payment receipt processes. The BA also reviewed, revised, and created several new policies and procedures to safeguard patients’ PHI. Breach notification was provided to affected individuals, both by letter and on the BA’s website. The BA provided required breach notification to HHS and media outlets in counties where affected individuals reside.