MVP Health Care, Inc.

The MVP Health Care Inc., the covered entity (CE), reported an impermissible disclosure of 951 patients’ protected health information (PHI) to other plan members due to an incorrect mailing. The CE provided breach notification to HHS, the media and affected individuals. As a result of OCR’s investigation, the CE updated its procedures for performing manual data manipulation, re-trained staff on the methods to manually sort data in Excel, and implemented a process for performing a quality review for all manual identification card projects. OCR provided technical assistance on conducting a thorough risk analysis, and the CE is expected to establish a risk management plan based on the appropriate risk analysis.