Blue Cross and Blue Shield of Nebraska

Due to a printing error, explanation of benefit forms were erroneously mailed to members that contained their protected health information (PHI) printed on the front side and another member’s PHI printed on the back side. The breach affected approximately 1,872 individuals and included financial, demographic, and clinical information. The covered entity (CE), Blue Cross and Blue Shield of Nebraska, was also acting as a BA for a number of self-insured health plans. The CE/BA provided breach notification to HHS, affected individuals, and the media. It also developed a new policy to address mechanical printing errors and trained its printing facility employees on the new policy. The CE/BA mitigated any potential effects by flagging and reviewing claims for six months for any misuse of dental data for the affected individuals. OCR obtained written documentation that the CE/BA implemented the voluntary corrective actions listed above.