RedCard, a business associate (BA) that provides mailing services to Blue Cross & Blue Shield of Rhode Island, the covered entity (CE), impermissibly disclosed protected health information (PHI) when it improperly consolidated explanations of benefits (EOB) in mailings, causing EOB documents for different individuals who resided at the same address (i.e., family members) to be mailed together. The breach affected the PHI of 1,567 individuals and included names, plan identification numbers, healthcare provider’s names, types of medical service provided, and claim information. Following the breach, the BA ceased consolidating EOBs. The CE provided breach notification to HHS, the media, and the affected individuals. OCR reviewed the CE’s BA agreement with the BA and it appeared to be in compliance with the Privacy Rule.
