MAXIMUS, Inc. / Business Ink, Co.

A business associate (BA) sent letters on behalf of the covered entity (CE) that were misaligned, resulting in individuals receiving letters with one page that contained other individuals’ protected health information (PHI), specifically, names and addresses. The breach affected 3,029 individuals. Following the breach, the BA retrained its staff members and updated its procedures, and the CE increased its auditing of the BA. OCR reviewed the CE's risk analysis to ensure compliance with the Security Rule and obtained assurances that the CE implemented the corrective actions noted above. The CE provided breach notification to HHS, affected individuals, and the media.