On March 12, 2016, the covered entity (CE), Kaiser Foundation Health Plan,, discovered that a truck belonging to its business associate (BA), Postage One was stolen and a pallet of printed "evidence of coverage" booklets for Inland Empire Health Plan members was missing. The missing booklets contained names, addresses, and a generic overview of covered benefits for 2,451 individuals. The CE, on behalf of its BA, provided breach notification to HHS, affected individuals, and the media. In response to the breach, the CE and BA reviewed and revised policies and procedures to require all mail to be unloaded and placed in a secured area where it can be monitored 24/7 and trained workforce members on mail security. The CE also provided OCR with additional documentation relevant to this breach investigation including its HIPAA Notice of Privacy Practices Policy. OCR obtained assurances that the CE and BA implemented the voluntary actions listed above.
