Humana Inc. [case #HU16004F3]

The covered entity (CE), Humana, Inc., mailed letters to subscribers instead of addressing the letters to their adult dependents due to a system error. The breach affected the protected health information (PHI) of 3,674 individuals, whose service notification letters were sent to their respective health plan subscribers instead of to the individual. The PHI on these service notification letters included names, identification numbers, dates of service, providers of services, and services approved. In response to the breach, the CE updated its Impermissible Use and Disclosures Policy and its Electronic Information Systems Policy, which now allows access only to those persons or software programs that have been granted access rights to view electronic PHI. The CE continues to provide HIPAA, Ethics, and Compliance Training to its staff. The CE provided timely breach notification to HHS, affected individuals, and media outlets in Louisville, KY and New Orleans, LA. OCR obtained assurances that the CE implemented the corrective actions listed above.