Wal-Mart Stores, Inc., the covered entity (CE), reported that the protected health information (PHI) of 771 individuals was disclosed when an internal file merging process error resulted in letters and refund checks being sent to the wrong recipients. The types of PHI included patient’s names, store locations, optical order numbers, dates of orders, and refund amounts. The CE provided breach notification to HHS and affected individuals and provided substitute notice via print media. Additionally, the CE provided evidence it implemented improved administrative safeguards and quality assurance protocols, and retrained staff to prevent similar incidents. OCR obtained assurances that the CE implemented the corrective actions listed above.
