> A cost/benefit analysis of "put all HIPAA-relevant information inside an opaque envelope" probably comes out ahead if it prevents one issue like this. To be

> A cost/benefit analysis of "put all HIPAA-relevant information inside an opaque envelope" probably comes out ahead if it prevents one issue like this. To be pedantic, the patient's name and address are both considered PHI under HIPAA. The way that most insurers deal with this is by mailing an envelope that has no obvious information on the outside about the sender (it has a return address that's usually a PO box somewhere in the midwest, but not the company's name). So without opening it, you can't tell that the piece of mail relates to medical information. Banks do this as well when mailing things like credit cards, to make it less obvious to a would-be interceptor of the mail that there's something valuable inside. (Of course, the deliberate inconspicuousness of it is itself conspicuous, but that's another problem).