Centene Management Corporation

An employee of a business associate (BA), Centene Management Company, impermissibly downloaded several data files containing the protected health information (PHI) of 8,208 individuals to an unauthorized removable storage device and then resigned from the organization. The former employee returned his company issued laptop on March 23, 2015. However, in violation of standard procedures, the laptop was not connected to the network for processing/reimagining at the time it was returned which allowed the impermissible downloads to go undetected. On October 8, 2015, a data loss prevention tool discovered the impermissible downloads when the former employee’s laptop was connected to the network for processing. The PHI involved in the breach included names, addresses, dates of birth, medical identification numbers, and in some cases social security numbers. The PHI downloaded belonged to members of the covered entities, Bridgeway Health Solutions and Superior Health Plan. The BA provided breach notification to HHS, affected individuals, and the media and also provided substitute notice. In response to the breach, the BA implemented and communicated a policy to help ensure the timely processing of returned information technology equipment. It also implemented a policy and software solution prohibiting the downloading of data to unauthorized, external storage. OCR provided technical assistance regarding the risk analysis and risk management provisions of the Security Rule.