Iowa Department of Health and Human Services

The covered entity (CE), Iowa Department of Health and Human Services, reported that an employee of its business associate (BA) inadvertently mailed the protected health information (PHI) of 833 individuals to the wrong recipients. The PHI involved included names, health insurance information, claims information, diagnoses, and other treatment information. The CE notified HHS, the media, and posted substitute notice on its website; the BA notified affected individuals. In response to the breach, the BA sanctioned the responsible employee and retrained its workforce on patient privacy and security.