HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of June 8, 2017.
- Organization as reported
- Tennessee Rural Health Improvement Association, TN
- Entity type as reported
- Health Plan
- Category as reported
Loss
- Location of information as reported
- Paper/Films
- Submission date
- June 8, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14169, row:5308)
- Archived copy
- Held in the private archive (provenance)
A business associate (BA) sent mail containing protected health information (PHI) that was damaged during transit, with pages missing upon receipt. The missing pages contained the PHI of 588 individuals, and included member identification numbers, dates of service, claim numbers, amounts billed, and amounts paid by the health plan. The covered entity (CE), Tennessee Rural Health Improvement Association, investigated the incident, gathering information from the intended recipient of the package, its mailing vendor, and the U.S. Postal Service, but the missing pages were not found. The CE provided breach notification to HHS, affected individuals, and the media, and also set up a toll free telephone number to answer questions. Following the breach, the CE began reducing the number of mailings sent to providers, encouraging participation in an electronic payment system, and working with its vendors to improve safeguards for mailings. OCR determined that the CE has an appropriate BA agreement in place with the BA. OCR obtained assurances that the CE implemented the corrective actions listed above.