HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

BA Printing Error Exposed PHI of Walmart Pharmacy Patients

An error by a vendor of Walmart has resulted in a limited amount of protected health information being disclosed to other pharmacy customers.

An error was made when one of Walmart’s vendors printed letters accompanying patient refund checks. That error resulted in patients’ protected health information being printed on letters intended for other individuals. Only a limited amount of information was disclosed, although this was sufficient to warrant the issuing of breach notification letters.  The incident has now been reported to the Department of Health and Human Services’ Office for Civil Rights. The breach report indicates 27,393 patients were impacted by the privacy breach.

The breach has not been posted on Walmart’s website at the time of writing, although an explanation of the breach was provided to databreaches.net. Walmart explained that the error occurred on or around May 13, 2016. The letters were mailed to patients on May 15, 2016., and Walmart was made aware of the error 5 days later.

Affected patients had their name, pharmacy prescription number or optical order number, order date, and the refund amount printed on letters sent to other individuals. The city/state of the store the patient visited was also included.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

The letters were accompanied by checks which Walmart has assured customers are valid and should be cashed. The checks are legitimate refunds for the recipient, and no error was made with the issuing of the checks, only with the accidental printing of additional information on the letters.

Due to the limited nature of PHI included on the letters, patients are not believed to be at risk of the information being used inappropriately. Patients have been sent breach notification letters in accordance with HIPAA Rules to alert them of the error and privacy breach.

Walmart has assisted its vendor by reviewing policies and procedures to prevent any future privacy breaches of this nature from occurring.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.