University Of Missouri Health

Due to an incorrect mail merge, on June 8, 2018, the covered entity (CE) sent letters to 706 patients in the Ear, Nose, and Throat Clinic to the wrong addresses. The breached protected health information (PHI) included names, addresses, zip codes, and treatment information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE sanctioned and retrained the workforce members whose actions led to the breach. It also provided education on verifying the information contained in a spreadsheet and ensuring that any changes made to data received does not impact the integrity of the original data. The CE also advised responsible staff that the printing services department should be provided a pre-sorted spreadsheet for future mailings. OCR obtained documented assurances that the CE implemented the corrective actions noted above.