ABB Inc. Active Employee Group Benefit Plan

The covered entity (CE), ABB Inc. Active Employee Group Benefit Plan, contracts with BlueAdvantage Administrators of Arkansas, a business associate (BA), to be a third party administrator for the CE’s medical plan for its U.S. employees. Due to a mailing error, the BA impermissibly disclosed the protected health information (PHI) of 6,877 plan members, including member names, ID numbers, and addresses. The CE provided breach notification to HHS and the media, and the BA provided individual notification. In order to prevent a similar mistake from happening in the future, the BA reviewed and made changes to its procedures and retrained staff. The BA also cancelled the member cards and ID numbers affected by the mailing, and issued new cards and ID numbers. OCR determined that the CE had a business associate agreement in place with the BA and obtained assurances that the CE implemented the corrective actions listed above.