Blue Cross Blue Shield of North Carolina

The covered entity (CE), Blue Cross Blue Shield of North Carolina, discovered on August 14, 2015, that its business associate (BA), EDM Americas, had accidently sent invoices to members that contained information for other members, affecting 1,530 individuals. The types of protected health Information (PHI) in the invoice included member names, addresses, internal account numbers, group numbers, coverage dates, and premium amounts due. The CE provided breach notification to HHS, on its website and to the media. The BA sent individual notification on behalf of the CE. In response to the breach, the BA retrained its staff and revised its internal validation and quality control procedures. OCR obtained assurances that the CE implemented the corrective actions listed above.