Blue Cross Blue Shield of North Carolina

The covered entity (CE), Blue Cross Blue Shield of North Carolina, discovered on August 24, 2015, that it had accidently sent payment letters to members that contained information for other members, affecting 806 individuals. The types of PHI in the letters included members' name, telephone numbers, health plans, effective dates, exchange identification numbers, payment amounts, and internal payment identification numbers. The CE provided breach notification to HHS, affected individuals, and the media, and posted substitute notice on its website. In response to the breach, the CE revised its mailing procedures to implement a two-step verification process before material is mailed. OCR obtained assurances that the CE implemented the corrective actions listed above.