The covered entity (CE), Volunteer State Health Plan, mailed three envelopes containing the protected health information (PHI) that arrived at the contracted provider’s address damaged, with the contents missing. The envelopes were damaged at the U.S. postal facility where they were processed and contained member claim information of 1,102 individuals, including members’ names, identification numbers, claim numbers, dates of service, procedure codes, charges, and provider information. In response to this incident, an investigator for the CE visited the mail facility where the damage occurred in an attempt to determine that the documentation was appropriately shredded under USPS policy for damaged mail. Additionally, the CE’s mailroom began using tear resistant envelopes for oversized mailings, and the CE trained its mailroom employees on the new envelope policy. Finally, the CE provided breach notification to HHS, the media, and affected individuals, and posted substitute notice on its website.
