On June 6, and August 13, 2013, the covered entity (CE) Missouri Department of Social Services, discovered that it’s business associate (BA), InfoCrossing Inc., mailed Missouri Medicaid (MO) participants’ enrollment correspondence to incorrect addresses during the period of October 16, 2011 to June 7, 2013. The correspondence contained MO Medicaid participants’ names, dates of birth, MO Medicaid account numbers, counties, phone numbers, and the last four digits of participants’ Social Security numbers, affecting approximately 1,546 individuals. The CE provided breach notification to HHS, affected individuals, and the media, as well as the Missouri Attorney General's Office. To prevent similar breaches from happening in the future, the CE deleted all its participants’ mailing addresses from its system and provided training to its workforce on its policies and procedures regarding cybersecurity awareness. OCR obtained documented assurances that the CE implemented the corrective actions listed above.
