IlliniCare Health Plan, Inc.

The covered entity (CE), IlliniCare Health Plan, Inc. (IlliniCare), reported that an employee inadvertently uploaded two files containing protected health information (PHI) to the Internet. The PHI involved included names, dates of birth, addresses, phone numbers, health insurance information, clinical information, medications prescribed, and other treatment information. IlliniCare notified HHS, affected individuals, and the media. In its mitigation efforts, the CE sanctioned the responsible employee, implemented additional administrative safeguards, and retrained its staff. OCR obtained assurances that IlliniCare implemented the corrective actions noted.