University of Rochester Medical Center and Affiliates

The covered entity (CE), University of Rochester Medical Center and Affiliates, reported that on April 19, 2010, 2,628 patient billing statements for Strong Memorial Hospital were sent to the wrong patients. The statements contained patients’ names, addresses, guarantors’ names, guarantors’ addresses, dollar amounts owed, health insurance plans, subscriber numbers, social security numbers, general descriptions of services rendered (such as inpatient room charge, outpatient visit charge, physical therapy, laboratory, pharmacy, radiology, etc.) and dates of service. The CE provided breach notification to HHS, affected individuals, and the media. As a result of the breach, the CE established a numerical counter to ensure that the numbers of statements that run through the folding machine are matching the numbers of statements that are printing. In addition, a report was added to the statement bundles distributed by the printing center that identifies the number of pages printed for each statement run. Further, a quality control process was put into place where a second staff member manually inspects stuffed envelopes on a random basis to ensure that the correct number of pages are inserted as well as verifying that the contents are all for the same patient. As a result of OCR investigation, OCR reviewed a copy of the CE’s risk assessment and policies and procedures relating to uses and disclosures of protected health information (PHI) and safeguarding PHI.