CASS and NCOA processing for breach notices

CASS and NCOA processing before anything prints.

Address hygiene on a marketing file is about postage discounts. On a notification file it is about whether an individual actually received legally required notice — which makes some standard mailing practices, particularly household de-duplication, actively dangerous here. This is what we run, what we report back, and what we refuse to do without your written instruction.

The question this page answers

What do you do to our file before printing, and what will you tell us about it?

The sequence

Six passes, in this order, for a reason.

Order matters: validating an address before standardizing it produces false failures, and de-duplicating before applying moves merges records that were never the same person.

01

Parse

Names and addresses split into discrete components; casing and abbreviations normalized.

02

CASS

Standardize to USPS format, validate to the delivery point, add ZIP+4.

03

NCOA

Apply filed changes of address from the USPS move file.

04

De-dupe

Exact and near-duplicate records identified — never merged across individuals.

05

Suppress

Likely decedents and foreign addresses flagged for your decision.

06

Report

Every exception classified, counted, and returned to you before production.

What each pass does

In plain terms.

Written so a lawyer can evaluate it, not so a mailing professional can nod along.

CASS

Standardize

Coding Accuracy Support System — the USPS-certified process that converts an address into standard postal form and confirms it corresponds to a real, mailable address. It fixes "123 Main Street Apartment Four, Springfield Ill" into a form the Postal Service can process, and it catches addresses that do not exist at all.

Delivery-point validation

Does it exist?

DPV confirms the address is a specific deliverable point, not merely a valid street and range. This is the difference between "500 Oak Ave is a plausible address on a real street" and "500 Oak Ave is a place mail is delivered." It is the single most useful signal on a notification file, because it identifies pieces that would fail before you spend postage on them.

Unit-level correction

Apartments

LACSLink updates addresses converted to new formats — typically rural routes renumbered for emergency services. SuiteLink adds missing secondary unit designators for known businesses. Missing apartment numbers are a leading cause of undeliverable mail in residential files, and this is where they get fixed rather than discovered in return mail.

NCOALink

Moves

The USPS change-of-address database. Where an individual filed a move, the record is updated to the new address and the change is reported to you. The standard dataset covers 18 months of filed moves; the 48-month dataset reaches further back and is the right choice on notification files, where addresses are often years old. We use the longer reach on notification matters unless you direct otherwise.

NCOA only knows about moves people formally filed with USPS. It cannot find someone who moved without filing — which is why return-mail management exists.

De-duplication

Individual only

Exact duplicates — the same individual appearing twice from a system join — are identified. Near-duplicates, where name and address match with minor variation, are flagged for your review rather than merged on our judgment. We do not household de-duplicate. Three affected people at one address get three letters.

Deceased suppression

Flag, not drop

Records matching commercial deceased-suppression data are flagged so a letter is not addressed to a deceased individual as though living — a genuine harm to a surviving family and a needless one. Whether to suppress, or to redirect to a personal representative, is your decision, and under HIPAA it interacts with a specific provision on deceased individuals. Nothing is dropped on our own initiative.

Foreign addresses

Split out

Non-US records are separated, since they cannot be CASS-processed, carry different postage, and often need a different envelope and transit expectation. They are quoted separately and reported as their own population so they do not silently fail inside a domestic mailing.

Move Update compliance

Postage

USPS requires address freshness within a defined period to qualify for presort pricing. Running NCOA satisfies it — so the hygiene that improves actual notice also preserves the postage rate. On a large mailing that is a material line item, and it is one of the few places where compliance and cost point the same direction.

The exception report

What comes back to you before anything prints.

One document, classified into what needs a decision now and what resolves later. On an emergency matter we triage it further so the call takes ten minutes.

CategoryWhat it meansTypical disposition
Corrected by CASSAddress standardized or completed; mailableInformational — no decision needed
Updated by NCOANew address applied from a filed moveInformational; counts reported
Not deliverableFails delivery-point validation; no fix availableDecide: mail anyway, research, or treat as unreachableThis is the population that drives substitute-notice exposure. It is worth ten minutes of your attention.
Missing unitMulti-unit building, no apartment numberSupplement from your source data if available; otherwise mail with elevated return risk
Exact duplicateSame individual, same address, more than onceSuppress the duplicate on your approval
Possible duplicateSimilar name and address; may be two peopleYour call, record by record — we do not guess
Possible decedentMatches deceased-suppression dataSuppress, redirect to a representative, or mail as addressed
ForeignNon-US addressApprove the separate quote or suppress
Missing dataNo name, no address, or unusable fieldsSupplement or exclude — cannot be mailed as-is

Every disposition you give is recorded and appears in the hygiene summary inside the evidence package, with counts that reconcile to the mailed totals. That record is what turns "we cleaned the file" into a documented, reviewable process.

Boundaries

Four things we will not do to a notice file.

Each of these is standard practice in commercial mailing and wrong for a legal notice.

Never

Household de-duplicate

Collapsing multiple affected individuals at one address into a single letter saves postage and defeats the purpose. Each individual is owed their own notice. A married couple both in the breach get two letters, in two envelopes.

Never

Invent or infer an address

We standardize, validate, and apply filed moves. We do not substitute a plausible address for an unmailable one. A letter sent to a guess is worse than a documented failure to reach someone.

Never

Drop records silently

Nothing leaves the file without your written disposition. Every suppression appears in the report with a reason and a count, and the arithmetic closes in the affidavit. Silent drops are how counts stop reconciling.

Never

Change a recipient's name

We standardize address components, not identities. Nicknames are not expanded, spellings are not corrected, and names are not merged. The name on the letter is the name you sent, because the manifest has to match your record.

What we need to run it

Name and address in discrete fields — not a single concatenated block, and not a report layout. ZIP as text so leading zeros survive. UTF-8 encoding, or tell us what you are sending so accented characters in a recipient's name arrive intact rather than as replacement glyphs on a legal notice. The full field layout is published on the incident-response partner page and applies to any matter, not just partner ones.

How long it takes

Processing itself is fast — a complete, conforming file of typical size is processed and reported within hours of receipt, including on emergency matters. What takes time is a file that needs parsing before it can be processed: addresses packed into one field, names split across inconsistent columns, or a list extracted from a PDF. That is careful manual work, it cannot be safely rushed, and it is the most common reason a 48-hour commitment cannot be made at hour zero. If your file is in rough shape, tell us early — we would rather fix it on day one than discover it on day two.

How the file is handled while we work on it

Processing happens inside the same controlled environment as production: encrypted at rest, access scoped to the matter team, logged. Address hygiene does not involve sending your file to a third-party service bureau — the processing is done in-house, which is why there is no subcontractor to add to your vendor review. Detail is on the Security & Compliance page.

What hygiene cannot fix

It is worth being direct about the ceiling. CASS and NCOA improve a file; they do not make a stale file current. If your source data is a customer list last verified in 2019, expect a meaningful undeliverable rate no matter what we run — and expect the exception report to tell you so before you mail rather than after. That early number is genuinely useful: it is the first reliable signal of how much substitute-notice exposure the matter carries, and it arrives while counsel still has time to plan for it. What happens next is covered under return-mail management.

Common questions

File and processing questions

Is address processing optional?

No. It runs on every matter, and it is included rather than priced as an add-on. Mailing a legal notice to an unvalidated file produces avoidable failures and no record of diligence — we will not do it, and a client asking us to skip hygiene to save a day is the one request we push back on hardest.

Our data-mining vendor already ran address hygiene. Do you re-run it?

Yes, and it is not redundant. Moves get filed between their run and our mail date, and we need the processing record for the evidence package to be ours rather than a reference to someone else's. It costs no additional time worth mentioning.

Will you tell us the expected undeliverable rate before we mail?

We give a directional estimate from the hygiene results — how many records failed validation, how many were updated by NCOA, how many are missing unit numbers. It is a projection, not a promise, and it is usually the most useful number in the exception report.

What about PO boxes and general delivery?

PO boxes are valid deliverable addresses and are mailed normally. General delivery and certain institutional addresses carry higher return risk and are flagged so you know they are in the population.

Can you match our file against a suppression list we provide?

Yes. Send the suppression list in the same secure channel and we will apply it as an explicit step, reported with its own count. Client-directed suppressions appear in the hygiene summary alongside ours so the record shows who suppressed what.

Do you keep the processed file?

Only through the matter's retention schedule, and the recipient file is returned or destroyed after the return-mail window closes. What persists is the hygiene summary and the manifest, which are the records evidencing the mailing.

Unsure whether your file is ready?

Send the header row and a few rows of fake data. We'll tell you what it needs.