On August 30, 2017, Florida Blue, the covered entity (CE), discovered that employees of its business associate (BA), Alliance & Associates Financial Services, Inc., impermissibly took protected health information (PHI) with them to their new place of employment, potentially exposing the names, dates of birth, addresses, social security numbers, medical history and some limited banking/payment information for 939 affected individuals. The CE provided timely breach notification to HHS, to the affected individuals and to the media. At the time of the breach and currently, the CE had a BA agreement in place with the BA. In response to the breach, the CE provided two years of credit monitoring to the affected individuals, obtained the PHI that was taken impermissibly, and obtained assurances that its PHI was not retained by the unauthorized entity. OCR obtained assurances that the CE implemented the corrective actions listed above and opened a separate review of the BA.
