BioIQ

On April 23, 2018, a business associate (BA), BioIQ, Inc., sent a mass email to members of TML Multistate Intergovernmental Employee Benefits Pool, the covered entity (CE), containing incorrect member names in the salutations. The breach involved the first and last names of 4,059 individuals who were members of the CE. The BA provided breach notification to HHS, the CE, affected individuals, and the media. Upon discovery of the breach, the BA immediately retrained the employee responsible for the incident. The BA also updated its email workflow procedures to include a quality assurance review of emails. OCR obtained assurances that the BA implemented the corrective actions listed above and provided technical assistance to the BA on its risk analysis and risk management plan.