WellCare Health Plans, Inc.

On July 13, 2017 and July 17, 2017, O’Neil Printing, Inc., a business associate (BA) of WellCare Health Plans, Inc. accidentally sent 1,214 mislabeled envelopes containing insurance membership identification cards to incorrect addresses. The mistake was discovered on July 20, 2017 and exposed the names, addresses, birthdates, and membership numbers of 1,214 affected individuals. In response to the breach, the CE and BA investigated the cause of the breach, finding that a problem in the naming conventions of the BA’s file processing had caused the name and address of members to become mismatched. The problem was promptly fixed and the BA implemented additional verification steps to prevent similar problems in the future. The CE provided timely breach notification to HHS, the affected individuals, and media outlets throughout the state of Missouri. It also mailed self-addressed, stamped envelopes to the individuals who received the mislabeled mail, along with an explanation, so that they could return the incorrectly-received information. OCR obtained assurances that the CE implemented the corrective actions listed above.