On July 25, 2018, the covered entity (CE), WellCare Health Plans, began receiving phone calls from members complaining that they had received a letter containing another member’s protected health information (PHI). The CE investigated and determined that between January 20, 2018, and June 20, 2018, appointment reminder letters for 26,942 members were mistakenly sent to the wrong members. The letters contained name, age, Medicaid number, healthcare providers, and a general reason for the appointment. Following the incident, the CE sanctioned the responsible staff members by terminating one individual, and retraining the other on HIPAA requirements. The CE also reviewed and updated its policies and procedures. As a result of OCR’s investigation, the CE created a new, automated procedure for mail reminder letters. The CE also provided breach notification to HHS, the affected individuals, substitute notice for affected members that couldn’t be located, and notice to the media.
