Illinois Department of Healthcare and Family Services

Family Health Network, a business associate (BA) for the covered entity (CE), Illinois Department of Healthcare and Family Services, mailed member identification cards to the wrong addresses due to a computer program error. The breach affected the protected health information of approximately 3,133 individuals and included names, dates of birth, and State-issued Medicaid numbers. Following the breach, the BA corrected the case number conversion process and manually reviewed the imported data. The CE and the BA reviewed their respective privacy policies and procedures and reminded all workforce members of those policies. The BA provided breach notification to HHS, the CE, affected individuals, and the media. OCR obtained documented assurances that the CE implemented the corrective actions steps noted above.