SEIU Local 32BJ, District 36 Building Operators Welfare Trust Fund

An employee of Express Scripts, a business associate (BA), inadvertently sent an email intended for the covered entity (CE) to another multi-employer health and welfare fund. The breach included the protected health information (PHI) of 911 individuals, including names, telephone numbers, social security numbers, dates of birth, and prescription information. The CE provided breach notification to HHS, affected individuals, and the media and provided credit monitoring to individuals. Following the breach, the CE ensured that the BA retrained the responsible employee. Additionally, OCR reviewed the CE’s risk analysis to ensure compliance with the Security Rule. The CE no longer does business with the BA.