Aflac

Some of the covered entity’s (CE) policyholders erroneously received welcome packets in the mail that contained the protected health information (PHI) of other individuals on a summary page. The breach affected 6,166 individuals and the types of PHI involved in the incident included policyholders’ names, coverage applied for, premium amounts, whether the applicant was a new employee, codes or names representing employees’ departments, and denial or acceptance of insurance coverage. In response to the breach, the CE updated its privacy and security procedures, which included updating its mailing process. The CE installed new printer software on all IT quality assurance (QA) desktops and on additional machines located in the IT QA lab. The CE also purchased and installed new local printers that will allow IT testers and coders to confirm packet accuracy. The CE provided breach notification to HHS, affected individuals, and the media. OCR obtained assurances that the CE implemented the corrective actions listed above.