Independence Blue Cross and AmeriHealth New Jersey

Members of the covered entity’s (CE) maintenance team improperly disposed of four boxes of paper records containing the protected health information (PHI) of approximately 12,450 individuals in error during the course of an office move within the building. The trash was collected by the CE’s trash removal vendor the next day and transported to a recycling plant. The PHI involved in the breach included names, addresses, identification numbers (including social security numbers), home phone numbers, physician information, health care plans, and group numbers. The CE was not able to determine whether or not someone at the recycling center may have acquired or viewed the PHI. The CE, Independence Blue Cross, provided breach notification to HHS, the media, and affected individuals. The CE offered all members who had their member identification number compromised one year of free credit monitoring. As a result of OCR’s investigation, the CE revised its policies and procedures for trash disposal, as well as maintenance and disposal of provider reports. The CE also sent a reminder to all associates regarding its policies and procedures for proper handling of paper documents and proper disposal of trash and documents containing PHI. Furthermore, the CE sanctioned the employees responsible for the incident. The CE initiated plans to provide additional staff training on its HIPAA policies and procedures for trash disposal.