Wrong-recipient drug test results and a safer release workflow

Overview

MyHealth sent another client’s employees’ drug test results in a report. The NPC closed the breach matter after reviewing notification, recipient deletion, and a revised release process that included encrypted PDFs, recipient and attachment checks, a release log, and acknowledgement of receipt. Closure reflected the response shown on this record.

Practice implications

Parao Law practice guidance

For physicians

Treat every emailed result as a final clinical release: confirm the patient, employer or recipient, attachment, and permitted scope before sending. If an error occurs, escalate immediately so affected people can be notified and the recipient asked to delete the data.

For lawyers

Build a documented release checklist and incident trail, including who received the file, containment steps, notices, and proof of corrective action. The closure does not mean that a recall alone cures a breach or that every similar incident is non-reportable.