BlueCross BlueShield of Western New York

The covered entity’s (CE) business associate (BA), Blue Cross Blue Shield, mailed a monthly premium notice with invoices that contained the protected health information (PHI) of 725 individuals which was never received by the CE. The PHI included names, member identification numbers, and social security numbers. Upon discovery of the breach, the BA contacted the U.S. Post Office regarding the undelivered mailing. The CE provided breach notification to HHS and the BA notified affected individuals. The BA revised its invoice procedures to assure the removal of social security numbers and member identification numbers, and send invoices via secure email. The breach incident involved a BA and occurred prior to the September 23, 2013, compliance date. OCR verified that the CE had a proper BA agreement in place that restricted the BA’s use and disclosure of PHI and required the BA to safeguard all PHI.