WellCare Health Plans, Inc.

On April 10, 2018, law enforcement notified Advanced Medical Reviews (AMR), a business associate (BA) of the covered entity (CE), WellCare Health Plans, that they had arrested an AMR employee for fraudulently impersonating a licensed physician. The employee, who had previously lost his medical license, allegedly used another physician’s credentials to gain employment and conduct medical reviews of 1,101 of the CE’s members which included accessing protected health information (PHI), including demographic and clinical information. The CE provided breach notification to HHS, affected individuals, and the media and established a toll-free information line and provided free credit monitoring. In response to the incident, the CE conducted a full examination of the incident, reviewed the impostor’s medical decisions, and worked closely with the BA to determine the extent of the breach. Additionally, the CE notified the relevant state and federal regulators. OCR obtained assurances that the CE implemented the corrective actions listed above.