Orthopedics NY, LLP

A workforce member created post card invitations for a golf tournament containing the patients’ names, addresses and that they had a total joint replacement. The covered entity (CE) sent the post card invitations to its printing vendor, which printed and mailed the invitations to 2,493 of the CE’s patients. The CE provided breach notification to HHS, the media and affected individuals. Following the breach, the CE re-trained the staff member responsible for creating the invitations regarding the Privacy Rule, implemented a process for the Compliance Officer to review all marketing mailing before distribution and entered into a business associate (BA) agreement with its printing vendor. OCR obtained assurances that the CE implemented the corrective actions listed. The CE is expected to review its practices to ensure compliance with the Breach Notification Rule’s Notice to Individuals requirements, to review its policies to ensure that it appropriately limits the PHI disclosed to the amount reasonably necessary to achieve the purpose of the disclosure, and to revise its HIPAA policy to ensure that the correct contact information is listed for each identified designated official to which workforce members may report any issues related to HIPAA.