The covered entity (CE), Special Agents Mutual Benefits Association, impermissibly disclosed the protected health information (PHI) of 1,394 individuals to the wrong subscribers when it distributed Form 1095-B notices for the 2017 tax year. The CE provided breach notification to HHS, the media, and affected individuals. The CE also offered affected individuals one year of complimentary credit monitoring and identity restoration services and established a toll-free assistance line to provide additional information regarding the incident, as well as steps to better protect against identity theft. Following the breach, the CE reissued corrected 1095-B forms. The CE terminated the relationship with the individual responsible for the programming error and implemented additional controls with its mailing vendor. During the investigation, OCR reviewed a copy of the CE’s current risk assessment. OCR determined that corrective action had resolved the issues in this case.
