CVS Caremark Part D Services
Disclosed Feb 23, 20242 years ago11,193 affectedConfirmed
The business associate (BA), CVS Caremark Part D Services, reported that a workforce member inadvertently mailed the protected health information (PHI) of 11,193 individuals to the wrong recipients. The PHI involved included names, dates of birth, and health insurance information. The BA notified HHS, affected individuals, and the media. In response to the breach, the BA retrained the workforce member and reviewed and improved administrative safeguards.
What is known
| People affected | 11,193 (as reported to HHS) |
|---|---|
| Disclosed | Feb 23, 2024 |
| Discovered | Dec 27, 2023 |
| Happened | Nov 20, 2023 |
| Attack | Lost or stolen device |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Washington Attorney General breach notice: CVS Caremark Part D Servicesatg.wa.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): CVS Caremark Part D Services (Business Associate, RI)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Washington AGresidents of WA | Feb 23, 2024 | 2,193 |
| HHS archivetotal | Feb 23, 2024 | 11,193 |
History of this record
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 11193 · backfill source
- 2026-09-25 · summary: empty to The business associate (BA), CVS Caremark Part D Services, reported that a workforce member inadvertently mailed the protected health information (PHI) of 11,193 individuals to the wrong recipients. The PHI involved included names, dates of · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Washington AG), confirmed by Washington AG. Record counts are as reported. Not legal advice.