A business associate (BA) of Group Health Inc., the covered entity (CE), impermissibly disclosed the protected health information (PHI) of 7,083 individuals when it mailed 2015 1095-B tax forms to the wrong members. The types of PHI involved in the breach included members’ names, addresses, dates of birth, and social security numbers. The CE provided breach notification to HHS, affected individuals and the media, and provided free credit monitoring to the affected individuals. Following the breach, the CE developed a frequently asked question document to assist staff to respond to calls regarding the breach, re-mailed the 1095-B tax forms, requested the return of the forms or attestation that the health information received was destroyed, and moved the print function of the 1095-B tax forms to another BA. As a result of OCR’s investigation, the CE is expected to continue to request the return or verify that the health information was destroyed and ensure that the CE’s BAs are trained on the provisions of Privacy, Security and Breach Notification Rules.
