The vendor had downloaded some electronic protected health information to a flash drive , which was then sent to an undisclosed recipient by mail using the U.S. Postal Service . The flash drive did not arrive at its destination . ;