Tufts Associated Health Maintenance Organization

A business associate (BA), Clarity Software Solutions, prepared a mailing of 70,320 member identification (ID) cards for Tufts Associated Health Maintenance Organization, the covered entity (CE). The member ID number was visible through the envelope window, in addition to the member’s name and address. Following the breach, the CE and BA revised their quality control procedures. The CE provided breach notification to HHS, the affected individuals, and the media. OCR’s investigation revealed that the CE and BA had a BA agreement in place at the time of the breach. OCR reviewed the BA agreement and determined that it appeared to comply with the requirements of the HIPAA Rules. OCR opened a separate review of the BA regarding this incident.