Clinical Reference Laboratory, Inc.

The covered entity (CE), Clinical Reference Laboratory, Inc. sent a parcel to Massachusetts Mutual Life that was opened and damaged during the mailing process by the United States Postal Services (USPS). The damaged parcel contained the protected health information (PHI) of approximately 864 individuals, including names, partial and full social security numbers, dates of birth, and clinical test codes. OCR received two other breach reports from the CE which involved the same or similar fact patterns as the breach report for this case. OCR consolidated these investigations into one breach compliance review. The CE investigated the breaches and concluded that the likelihood of misuse or further disclosure of the PHI was remote since the USPS confirmed that all unmatched pages were segregated and shredded. The CE provided breach notification to HHS, affected individuals, and notified appropriate authorities required by each jurisdiction that included an affected individual. The CE also offered affected individuals a free two-year subscription to credit monitoring services and credit report controls. Following the breach, the CE appointed a new privacy officer, who was required to complete HIPAA training, and verified that its workforce received HIPAA-related training. The CE also implemented a new breach reporting procedure and initiated the implementation of a secure online portal for clients to obtain PHI electronically. OCR obtained documentation evidencing that the CE implemented the corrective actions listed.