Emblem Health - GHI

Group Health Inc., the covered entity, (CE) reported that its business associate (BA) mailed letters to approximately 88,112 members with their social security number on the mailing label. The types of protected health information (PHI) involved in the breach included names, addresses, and social security numbers. The CE provided breach notification to HHS, affected individuals, and the media and provided free credit monitoring to the affected individuals. Following the breach, the CE revised its mailing procedures, sanctioned the employees whose action contributed to the breach, and trained employees and vendors on information security, privacy and quality assurance for member mailings. As a result of OCR’s investigation, the CE is expected to transition to a new IT operating platform during 2018, which should reduce the likelihood of this type of incident occurring again. The CE is also expected to take additional corrective actions pursuant to a consent judgment reached by the CE with the Attorney General of the State of New York.