Willis North America Inc Medical Expense Benefit Plan

A group health plan administrator emailed 1,889 plan participants a spreadsheet containing the protected health information (PHI) of 4,830 plan participants, including their names, dates of birth and social security numbers. The covered entity (CE), Willis North America Inc. Medical Expense Benefit Plan, provided breach notification to HHS, the media, and the affected individuals, including the offer of two years of identity theft protection at no cost to the affected individuals. Following the breach, the CE blocked recipients’ ability to forward the email, deleted the email from recipients’ inboxes, and instructed recipients to delete the email and not save or forward it. The CE also tracked all instances of recipients forwarding the email prior to the block and obtained assurances that the PHI had been deleted, no copies kept, and such PHI had not been and would not be used for any improper purpose. The CE also instructed its workforce members to follow new protocols for handling PHI, including encrypting and password-protecting attachments with sensitive information prior to transmission and, when possible, opening such information in a secure shared drive as opposed to emailin