California Physicians' Service

On May 18 2015, the covered entity (CE), Blue Shield of California, discovered that several authorized users who logged into their accounts were able to access the protected health information (PHI) of individuals who were not affiliated with their line of business due to a faulty update to the restricted web portal. The PHI of 843 individuals was affected and included names, addresses, birthdates, social security numbers, and other identifiers. The CE provided breach notification to HHS, affected individuals, and the media. In response to the breach, the CE disabled the portal, deployed a patch code to correct the problem, and improved the code testing process. The CE also sanctioned the developer who failed to follow the code merge process. OCR reviewed the CE’s HIPAA Notice of Privacy Practices Policy, as relevant to this breach investigation, and obtained assurances that the CE implemented the corrective actions listed above.