In early September 2018, the Michigan Medicine Development Office initiated a fundraising campaign that involved transmitting letters to a large amount of its patients. A third-party vendor was hired to print the letters for the mailing and while many of the letters were printed properly, a mistake was made by the printing company that lead to an impermissible disclosure of certain patients’ personal data.
According to Michigan Medicine, the error was happened when the printing company installed new software. As a result of the mistake, a proportion of the letters contained data that was meant for other Michigan Medicine patients and did not match the name and address on the exterior of the envelope.
Since this was a fundraising correspondence, the letters did not include any medical details, Social Security numbers, financial data, or other highly sensitive data. Patients impacted by the mistake has their name, address, and in some cases email address and contact telephone number, disclosed to another Michigan Medicine patient.
The error was discovered by Michigan Medicine on September 4, 2018 and swift action was implemented to alert the vendor to the error to stop any further impermissible disclosures of patient data.
“Patient privacy is extremely important to us, and we take this matter very seriously,” stated Jeanne Strickland, Michigan Medicine chief compliance officer. She added that “Michigan Medicine took steps immediately to investigate this matter.”
As an additional measure to stop breaches like this, Michigan Medicine’s Development Office will be using window envelopes for future mailings, cutting out the need to match envelopes with letters.
The Mailing mistake was a reportable breach under HIPAA and the Department of Health and Human Services’ Office for Civil Rights (OCR) was alerted well inside the 60-day reporting deadline. The breach summary on the OCR website states that 3,624 patients were impacted by the incident.
