Orchid MPS Holdings, LLC Welfare Benefit Plan

On March 30, 2016, a vendor of Orchid MPS Holdings, LLC Welfare Benefit Plan, the covered entity (CE), improperly disclosed protected health information (PHI) by mailing IRS Forms 1095-C to the wrong recipients. The breach affected 771 individuals and included addresses, zip codes, names, and social security numbers. The CE provided breach notification to HHS and affected individuals. The CE instructed employees to return to Human Resources the 1095-C forms they received in error and provided free credit monitoring and identity theft protection to individuals affected by the breach. Following the breach, the CE terminated its contract with the vendor that caused the breach and entered into a business associate agreement with a new vendor. The CE also implemented additional procedures to reduce the incidence of error in the 1095-C reporting process, including personally distributing forms to current employees and ensuring the forms contain only the minimum necessary information. OCR obtained documented assurances that the CE implemented the corrective actions listed above.