The covered entity (CE), Health First Health Plans, reported an error with its query code that pulls member addresses from its system. The error caused member documents to be mailed to expired addresses. The CE found that a contractor failed to follow its Change Management Procedure. The error affected the protected health information (PHI) of 701 individuals. The PHI disclosed included member names, member IDs, member dates of birth, authorization, and prescription information. The CE notified the HHS Secretary, affected individuals, and the media. In response to the breach, the CE updated its Change Management Procedure and implemented a new procedure that outlined addresses that should be maintained in its system and for what purpose the addresses should be pulled. CE also provided associates and employees with additional training on the new and updated policies. OCR obtained assurances that the CE implemented the corrective actions noted above.
