Blue Cross Blue Shield of Michigan

OCR opened an investigation of the covered entity (CE), Blue Cross Blue Shield of Michigan, after it reported that the protected health information (PHI) of 3,903 of its patients had been stolen for the purposes of identity fraud. The types of PHI disclosed included names, ages, genders, dates of birth, contract numbers, group names and numbers, and social security numbers. The CE provided breach notification to HHS, the media and affected individuals. Following the breach, the CE improved safeguards by masking social security numbers, removing members’ dates of birth, limiting search results to 25 records, and installing new printing devices that require employees to scan their coded badges when printing. OCR obtained assurances that the CE implemented the corrective actions listed above.