I'm wondering if sending snail mail to the wrong address could ever be a violation of HIPAA? Obviously, due to people moving and not updating their account information, this likely happens all the time
However, what if an insurance member has requested an address change from the insurance company (multiple times) but the company fails to update their address in the system and continues to send documents (Explanations of Benefits) to the wrong address?
Under 45 CFR 164.402 a "breach" is
the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E of this part which compromises the security or privacy of the protected health information.
Disclosing PHI to random people is not permitted under subpart E. Then then allow that it can be deemed to not be a breach if they can "demonstrate[] that there is a low probability that the protected health information has been compromised based on a risk assessment of certain factors – there isn't any clear yes/no rule as to how you could say that disclosing PHI is not a breach.
If they discover a breach, they must notify the affected individual. One ploy would be for them to stick their heads in the sand and be careful to not discover: but §164.404(2) says
A covered entity shall be deemed to have knowledge of a breach if such breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is a workforce member or agent of the covered entity
So if, for example, they had been told that person X has moved, a reasonably diligent person would know that sending PHI to the old address will result in a breach. The Sec'y of HHS must also be notified of the breach, though this can go in the annual report if the breach involves fewer than 500 people. The affected individual can also file a complaint with HHS.
