HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Feb. 11, 2019.
- Organization as reported
- Rush University Medical Center, IL
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- Feb. 11, 2019
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13539, row:4678)
- Archived copy
- Held in the private archive (provenance)
Rush University Medical Center, the covered entity, reported that protected health information (PHI), was incorrectly sent to patient addresses via a letter campaign. This error caused letters to be sent to addresses with the wrong patient names on the outer envelope. This breach affected 908 individuals. The PHI involved in the breach incident were names. To mitigate this breach and prevent similar accidents, the covered entity implemented a mass mailing policy, which required management review before mailing and included a mailing checklist. The covered entity provided primary, substitute, and media notice to affected individuals. As a result of OCR’s investigation the covered entity updated its policy regarding the safeguarding of PHI and distributed it to staff. The covered entity provided OCR with documentation of all actions taken in this matter.