On August 8, 2018, and September 4, 2018, the covered entity's (CE’s) business associate (BA), Xerox Corporation, erroneously printed appointment reminder cards for patients that were mailed to another patient. The two incidents affected a total of 19,254 individuals and included demographic and clinical information. The CE/BA provided breach notification to HHS, affected individuals, and the media. To protect against any other printing misalignment incident, the BA instituted additional processes and preventative measures such as joint BA and CE review of templates and programming prior to printing and a match alert notification. OCR reviewed a copy of the BA agreement, the individual breach notification letter, as well as the security measures implemented to address risks and vulnerabilities. OCR obtained assurances that the CE implemented the corrective actions listed.
