Windsor Health Plan

A third-line sub-contractor of Windsor Health Plan’s business associate (BA), CVS Caremark, changed the printing format on letters mailed to the covered entity’s (CE) members, potentially causing protected health information (PHI) to be visible through the envelope window. The letters included the names, addresses, and some clinical information of 1,378 individuals. RxAmerica, an operating subsidiary of CVS Caremark, subcontracted its mailing services to Accendo, who in turn subcontracted printing services to Progressive Direct Mail (PDM). The CE provided breach notification to HHS and affected individuals; media notification did not occur because the impacted members did not exceed 500 in any single state or geographic area. However, CVS issued a media release regarding the incident. In response to the incident, Accendo conducted a full review of the incident, notified PDM of the formatting error, and ensured it was corrected. Accendo also conducted an onsite visit at the PDM facility and implemented new quality assurance protocols and internal validation steps. OCR obtained written assurances the CE provided the breach notification as indicated above.