The covered entity (CE), Health Advantage, mailed Personal Health Statements to approximately 2,863 plan members’ previous addresses due to an internal programming error. This incident affected additional patients (addressed in separate breach reports) in that the covered entity had contracted with other covered entities, BCBS of Arkansas, the State of Arkansas Department of Finance and Administration Employee Benefits Division health plan and Baptist Health System’s health plan. The protected health information (PHI) involved in the breach included patients’ demographic information, health insurance identification numbers, descriptions of treatment or services received, and names of treating facilities or providers. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE corrected the programming error, purged outdated information from its system, and implemented new quality control procedures for mailings. As a result of OCR’s investigation, Health Advantage also revised or entered into multiple business associate agreements.
