University of Alabama at Birmingham School of Nursing

The covered entity (CE), University of Alabama at Birmingham School of Nursing, reported that workforce members sent a postcard containing the protected health information (PHI) of 1,655 individuals, which was visible. The PHI involved included names, addresses, diagnoses/conditions, and location of treatment. The CE notified HHS, affected individuals, the media, and provided substitute notice on its website. In response to the breach, The CE sanctioned the responsible staff and implemented additional administrative safeguards.