Amerigroup Community Care of New Mexico

A workforce member of the covered entity (CE), Amerigroup Community Care of New Mexico, accessed the company data system to compile a list of members’ names, dates of birth, and social security numbers. The protected health information (PHI) of approximately 1,526 individuals was involved in the breach. The workforce member did not have a job specific purpose for accessing and downloading the information. Following this breach, the CE terminated the workforce member involved. Further, the CE conducted an internal review of its procedures to determine whether additional security controls are needed. As a result of OCR’s investigation, the CE provided additional training, through email reminders, about workforce members’ responsibilities to protect member information and to report incidents when observed.