Complete Medical Homecare did nt encrypt emails sent to trusted business partners like All American Medical Supplies . That failure to encrypt , combined with human error , resulted in a regrettable privacy breach . On December 27 , CMH discovered that materials with patients names , addresses , dates of birth , Social Security numbers , and certain medical diagnoses had been transmitted to AAMS on December 12 . AAMS then used that information , in error , to send introductory letters to the patients and , in some cases , they sent them medical equipment . When CMH discovered their error , they contacted AAMS , who destroyed their copy of the data , and agreed that no further letters would be sent out . Patients who received equipment from AAMS were asked to contact them to arrange for the return of the equipment at no cost to them . Because CMH and AAMS are both covered by HIPAA , this breach was not as bad as it might have been , although clearly it was an unintended disclosure of PHI that patients needed to be informed about . As part of preventing future incidents of this kind , CMH is undertaking a number of steps , including deploying encryption when emailing outside the company . Actually , they should have been doing that anyway , as even though they may trust the recipient , failure to encrypt allows capture or interception of the communications by attackers . You can read CMHs report to the New Hampshire Attorney Generals Office and their notification to three New Hampshire residents here ( pdf ) . The total number of patients notified was not reported . Update : The breach also affected 16 Maryland residents , but we still do nt know the total number affected . ;