Blue Cross and Blue Shield of North Carolina

On October 14, 2013, the covered entity (CE), Blue Cross Blue Shield of North Carolina, impermissibly disclosed the protected health information (PHI) of 687 individuals when an employee inadvertently mailed notices regarding policy changes to incorrect addresses. The PHI involved in the breach included names. The CE provided breach notification to HHS and affected individuals. Following the breach the CE sanctioned the responsible workforce member. As a result of OCR’s investigation, the CE provided media notice and established a toll-free number for affected individuals. Additionally, the CE improved safeguards by retraining employees and initiating a regular review of mailing procedures.