HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Aug. 1, 2018.
- Organization as reported
- Southwestern Eye Center, AZ
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- Aug. 1, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13733, row:4872)
- Archived copy
- Held in the private archive (provenance)
During a mass mailing of patient refund checks in April 2018, the covered entity’s (CE’s) business associate (BA) used an electronic mail merge and mixed up the names and addresses on patient refund checks mailed to 667 individuals. The breach, reported to HHS on August 1, 2018, included demographic information. The CE provided breach notification to HHS, affected individuals and the media. OCR obtained assurances that the CE took voluntary corrective action by re-issuing and re-sending the patient refund checks correctly, terminating its contract with its BA, implementing random auditing of patient demographics on pending patient refund checks, and revising its procedure so that its accounting department reviews and validates patient refund checks prior to mailing.