Rush University Medical Center

Rush University Medical Center, the covered entity, reported that protected health information (PHI), was incorrectly sent to patient addresses via a letter campaign. This error caused letters to be sent to addresses with the wrong patient names on the outer envelope. This breach affected 908 individuals. The PHI involved in the breach incident were names. To mitigate this breach and prevent similar accidents, the covered entity implemented a mass mailing policy, which required management review before mailing and included a mailing checklist. The covered entity provided primary, substitute, and media notice to affected individuals. As a result of OCR’s investigation the covered entity updated its policy regarding the safeguarding of PHI and distributed it to staff. The covered entity provided OCR with documentation of all actions taken in this matter.