The covered entity (CE), South Texas Veterans Health Care System, incorrectly mailed 2,000 letters with another veteran’s protected health information (PHI) printed on the other side. The types of PHI involved in the breach included patients’ names, addresses, and medication information. The CE provided breach notification to HHS, affected individuals, and the media. As a result of OCR’s investigation, the CE updated its procedures for fulfilling mailing requests and issued a memorandum to the print shop staff with the revised procedures and forms.
