MetroPlus Health Plan

Staff members sent unencrypted files containing the electronic protected health information (ePHI) of 808 members of the covered entity (CE), including demographic information, to a vendor that was not a business associate (BA) of the covered entity (CE). The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE ensured that its vendor destroyed the ePHI and retrained the staff members responsible for the breach incident regarding information security. The CE updated its annual training to include information regarding interactions with its vendors, including data sharing, and implemented a new standard operating procedure regarding file transfers. The CE also documented the unauthorized disclosure of its members’ ePHI for accounting of disclosure purposes. As a result of OCR’s investigation, the CE is expected to perform a thorough and accurate risk analysis and establish a risk management plan. Also, the CE is expected to implement technical security measures to guard against unauthorized access to ePHI that is being transmitted over an electronic communications network. In addition, the CE is expected to provide periodic security updates to workforce members regarding safeguarding ePHI in transmission, and revise its policies and procedures regarding breach notification and provide training to workforce members on the revised policies and procedures.