Breachesby GlyphCVS Caremark Part D Services
Disclosed Feb 23, 202411,193 affectedConfirmed
The business associate (BA), CVS Caremark Part D Services, reported that a workforce member inadvertently mailed the protected health information (PHI) of 11,193 individuals to the wrong recipients. The PHI involved included names, dates of birth, and health insurance information. The BA notified HHS, affected individuals, and the media. In response to the breach, the BA retrained the workforce member and reviewed and improved administrative safeguards.
What is known
| People affected | 11,193 (as reported to HHS) |
|---|---|
| Disclosed | Feb 23, 2024 |
| Discovered | Dec 27, 2023 |
| Happened | Nov 20, 2023 |
| Attack | Lost or stolen device |
| Data exposed | NamesHealth |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
Notices filed
History of this record
[] to ["names","health"]by backfillSource
empty to hhsby backfillSource
empty to 11193by backfillSource
empty to The business associate (BA), CVS Caremark Part D Services, reported that a workforce member inadvertently mailed the protected health information (PHI) of 11,193 individuals to the wrong recipients. The PHI involved included names, dates ofby backfillSource
First recordedby backfillSource
First seen 2026-09-25 (Washington AG), confirmed by Washington AG. Record counts are as reported. Not legal advice.