HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 22, 2011.
- Organization as reported
- Windsor Health Plan, TN
- Entity type as reported
- Business Associate
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- July 22, 2011
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15810, row:6949)
- Archived copy
- Held in the private archive (provenance)
A third-line sub-contractor of Windsor Health Plan’s business associate (BA), CVS Caremark, changed the printing format on letters mailed to the covered entity’s (CE) members, potentially causing protected health information (PHI) to be visible through the envelope window. The letters included the names, addresses, and some clinical information of 1,378 individuals. RxAmerica, an operating subsidiary of CVS Caremark, subcontracted its mailing services to Accendo, who in turn subcontracted printing services to Progressive Direct Mail (PDM). The CE provided breach notification to HHS and affected individuals; media notification did not occur because the impacted members did not exceed 500 in any single state or geographic area. However, CVS issued a media release regarding the incident. In response to the incident, Accendo conducted a full review of the incident, notified PDM of the formatting error, and ensured it was corrected. Accendo also conducted an onsite visit at the PDM facility and implemented new quality assurance protocols and internal validation steps. OCR obtained written assurances the CE provided the breach notification as indicated above.