University of New Mexico

The covered entity (CE), The University of New Mexico, inadvertently mailed invoices intended for third party payers to random patients’ addresses due to an error in the CE’s billing system. The protected health information (PHI) included patients' names, patient care service categories, clinic names, pharmacies, and dates of service for 2,898 individuals. Upon discovering the breach, the CE manually reviewed its billing programs and put a hold on the billing program that created the error. The CE provided breach notification to HHS, affected individuals, and the media. As a result of the breach, the CE improved technical and administrative safeguards and retrained appropriate staff on its updated procedures. OCR obtained assurances that the CE implemented the corrective actions listed above.