HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of April 13, 2016.
- Organization as reported
- American Fidelity Assurance Company, OK
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- April 13, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14559, row:5698)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), American Fidelity Assurance Company, erroneously mailed letters to customers containing pages that belonged to another customer due to a mailroom equipment malfunction and manual sorting by an employee. The types of protected health information (PHI) involved in the breach included providers’ names, treatment dates, customers’ names, customers’ employers’ names, and customers’ employer identification numbers. Approximately 2,664 individuals were affected by this incident. The CE provided breach notification to HHS, all potentially affected individuals, and the media. The CE also offered credit monitoring services. The CE retrained staff on safeguarding PHI and verbally reprimanded the employee involved in the incident. As a result of this incident, the CE decided to outsource its mailing and sorting process with a business associate using a fully automated sorting process which provides positive assurance and audit capability. In addition, the CE added quality control measures to their mailing process. OCR obtained assurances that the CE implemented the corrective actions listed above.