WellSpan Health

As a result of a software error, a business associate (BA) misaddressed explanation of benefit (EOB) letters and they were delivered to persons other than the intended recipient. The breach affected approximately 732 individuals and the types of protected health information (PHI) included names, addresses, and clinical and diagnostic information. Breach notification was provided to HHS, affected individuals, and the media. Following the breach, the BA implemented a new audit process for mailings, and retrained staff members. OCR reviewed the CE's policies and procedures to ensure compliance with the Privacy and Security Rules.