Colorado Department of Health Care Policy & Financing

On July 30 and September 3, 2014, a business associate (BA) mistakenly sent postcards to the covered entity’s (CE) clients that contained viewable protected health information (PHI). The breached PHI included names, addresses, and referred to each client’s status as a public assistance client receiving behavioral health care services. The resulting breach affected approximately 15,380 individuals. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE and its BA ceased using postcards to conduct client satisfaction operations and implemented new policies and procedures to address the circumstances that led to the breach. The CE and BA also counseled and trained the employee responsible for approving the postcard and provided additional privacy training to all workforce members of the departments responsible for approving such mailings. OCR obtained assurances that the CE and BA implemented the corrective actions noted above.