Southwest Oregon IPA

On or about July 21, 2017, or July 25, 2018, the covered entity (CE), Southwest Oregon IPA, sent open-faced postcard to 1,449 plan members asking them to return the free colon cancer test that the plan sent to them one month prior. The postcards contained members’ names, addresses, PCP clinics, and requests to send back the tests. The CE provided breach notification to HHS, affected individuals, and the media. As a result of OCR’s investigation, the CE provided OCR information that it implemented a document control process. The CE ceased using postcards for member mailings and updated its HIPAA Privacy Manual to reflect the changes. OCR obtained assurances that the CE implemented the corrective actions listed here.