TOWERS WATSON

A business associate (BA), Towers Watson, of the covered entity (CE), General Agencies Welfare Benefits Program, lost two electronic media disks containing protected health information (PHI) while transporting the disks between two BA offices. The disks contained the names, health plan numbers, and social security numbers of 1,874 individuals. The BA notified all affected individuals and provided two years of enhanced credit services. The CE notified HHS and the media and posted substitute notice on its website. The CE had the BA destroy any of its PHI that had been retained by the BA and executed a new BA agreement for any remaining PHI that the BA was unable to destroy because they were archival files. After OCR's investigation, the CE updated its privacy and breach notification policies and procedures. \ \