Southwestern Eye Center

During a mass mailing of patient refund checks in April 2018, the covered entity’s (CE’s) business associate (BA) used an electronic mail merge and mixed up the names and addresses on patient refund checks mailed to 667 individuals. The breach, reported to HHS on August 1, 2018, included demographic information. The CE provided breach notification to HHS, affected individuals and the media. OCR obtained assurances that the CE took voluntary corrective action by re-issuing and re-sending the patient refund checks correctly, terminating its contract with its BA, implementing random auditing of patient demographics on pending patient refund checks, and revising its procedure so that its accounting department reviews and validates patient refund checks prior to mailing.