BlueCross BlueShield of TN, Inc.

The covered entity (CE) discovered on July 5, 2017, that it mailed a monthly report to employer health plan administrators that erroneously included the protected health information (PHI) of members enrolled in another group due to a software discrepancy. The mailings included demographic and health insurance information, affecting approximately 2,117 individuals. In response to the breach, the CE updated and tested all of its systems and manually reviewed every report prior to mailing until transitioning to an electronic-based reporting system in November 2017. The CE provided breach notification to HHS, affected individuals, and the media. The CE sent information to all employees explaining the incident and the steps it took to respond to the breach and used the incident to re-educate the employees about their responsibilities under HIPAA. OCR obtained assurances that the CE implemented the corrective actions listed above.