Walgreen Co.

On June 8, 2015, the covered entity (CE), Walgreens Pharmacy, reported that its vendor, Kurtzman Carson Consultants LLC, mailed lawsuit settlement postcards to individuals that included protected health information (PHI) in addition to addresses that was viewable during the postal route. The PHI included the prescription information, insurance and other health information of approximately 8,345 individuals. The CE mitigated the breach by directing the vendor to remove information from the affected individuals’ contact information for future mailings related to the proposed class action settlement and revised applicable policies and procedures. The CE provided breach notification to HHS, affected individuals, and the media and established a call center to field consumer questions. OCR obtained documented assurances that the CE implemented the corrective actions listed above.