A former employee of the covered entity’s (CE) business associate (BA), CVS Health, impermissibly exfiltrated the CE’s member information from its systems and saved the protected health information (PHI) onto his personal computer. The PHI involved in the breach included full names, member identification numbers, health card numbers, plan codes and states, and start and end dates. The breach affected approximately 54,203 individuals. The CE provided breach notification to HHS, affected individuals, and the media, and also provided substitute notification. The CE also offered individuals one year of free identity theft protection membership. As a result of this incident, the CE required the BA to improve safeguards by enhancing security for the BA’s fraud management tool and databases containing PHI, and updating its security procedures. OCR reviewed the CE’s policies, procedures, and/or documentation related to impermissible disclosures, safeguards, business associates, and breach notification and obtained assurances that the BA implemented the corrective actions listed above.
