Tennessee Rural Health Improvement Association

A business associate (BA) sent mail containing protected health information (PHI) that was damaged during transit, with pages missing upon receipt. The missing pages contained the PHI of 588 individuals, and included member identification numbers, dates of service, claim numbers, amounts billed, and amounts paid by the health plan. The covered entity (CE), Tennessee Rural Health Improvement Association, investigated the incident, gathering information from the intended recipient of the package, its mailing vendor, and the U.S. Postal Service, but the missing pages were not found. The CE provided breach notification to HHS, affected individuals, and the media, and also set up a toll free telephone number to answer questions. Following the breach, the CE began reducing the number of mailings sent to providers, encouraging participation in an electronic payment system, and working with its vendors to improve safeguards for mailings. OCR determined that the CE has an appropriate BA agreement in place with the BA. OCR obtained assurances that the CE implemented the corrective actions listed above.