Livongo Health

The covered entity (CE) learned that its business associate (BA) mislabeled certain packages containing lancet devices so that the devices were sent and delivered to the correct address, but the shipping label stated the wrong name for the CE's members. The label included the wrong member’s name and information from which it could be incorrectly inferred that the individual was to receive a lancet device from the CE and had diabetes. This breach affected 1,950 individuals. The CE provided breach notice to HHS and affected individuals. Following the breach, the CE terminated its relationship with this BA, added a quality assurance process, and communicated the new process to its staff. OCR obtained documented assurances that the CE implemented the corrective actions listed above.