CarePlus Health Plans [case 18772]

On September 18, 2015, the covered entity (CE), CarePlus Health Plans, discovered that “Late Enrollment Penalty Premium Statements” mailed to members on September 11, 2015, had been mailed to incorrect members. The printing apparatus was accidently programmed to insert two statements per envelope instead of one. The types of protected health information (PHI) involved in the mailing included the names, addresses, and identification number of 2,873 members. In response to the breach, the CE mailed correct statements, sanctioned the responsible employee, and retrained employees in the printing and correspondence department. The CE provided breach notification to HHS, to affected individuals, on its website and to the media. OCR obtained assurances that the CE implemented the corrective actions listed above.