The covered entity (CE), Superior HealthPlan, Inc., mistakenly sent mail containing protected health information (PHI) to unrelated members. Approximately 6,284 individuals were affected. The PHI involved in the breach included names, addresses, and identification numbers. The CE provided breach notification to HHS, the media, and affected individuals, and posted substitute notice on its website. It also offered credit and identity theft protection to the affected parties. As a result of OCR’s investigation, the CE implemented procedures to improve accuracy of mailings. In addition, the CE improved safeguards by implementing a periodic audit to assure that IDs are matched to mailing addresses.
