Massachusetts General Hospital

Due to an error during a mail merge, a business associate (BA) sent letters to patients’ home addresses with the wrong patients’ names on them, causing the protected health information (PHI) of 580 patients to be disclosed to other patients. This letter notified patients that their doctor at the covered entity (CE), Massachusetts General Hospital, was retiring and included patients’ names. The CE provided breach notification to HHS and affected individuals. Following the breach, the CE retrained staff on safeguarding PHI during a mail merge. The CE also terminated the BA relationship and began handling all mailings internally. OCR obtained assurances that the CE implemented the corrective actions noted above.