Contra Costa Health Plan

On May 22, 2018, the covered entity (CE), Contra Costa Health Plan, discovered that a business associate (BA) had provided services under a false identity. The CE investigated and determined that during her work for the CE the BA had access to 862 health plan enrollees’ protected health information (PHI), including demographic and clinical information. Following the breach, the CE immediately terminated the BA contract and the individual contractor’s access to the CE’s records. The CE conducted a thorough forensic audit trail investigation and did not find any evidence of improper access, use, or disclosure of enrollee PHI by the contractor. The CE provided breach notification to HHS, affected individuals, and the media. OCR obtained assurances that the CE implemented the corrective actions listed above.