Willis North America Inc. Medical Expense Benefit Plan

A group health plan administrator emailed 1,889 plan participants a spreadsheet containing the protected health information (PHI) of 4,830 plan participants, including their names, dates of birth and social security numbers. The covered entity (CE), Willis North America Inc. Medical Expense Benefit Plan, provided breach notification to HHS, the media, and the affected individuals, including the offer of two years of identity theft protection at no cost to the affected individuals. Following the breach, the CE blocked recipients’ ability to forward the email, deleted the email from recipients’ inboxes, and instructed recipients to delete the email and not save or forward it. The CE also tracked all instances of recipients forwarding the email prior to the block and obtained assurances that the PHI had been deleted, no copies kept, and such PHI had not been and would not be used for any improper purpose. The CE also instructed its workforce members to follow new protocols for handling PHI, including encrypting and password-protecting attachments with sensitive information prior to transmission and, when possible, opening such information in a secure shared drive as opposed to emailing it. The CE also sanctioned the administrator. Additionally, the CE adopted HIPAA policies and procedures relating to the handling of PHI, updated its HIPAA training, and completed an assessment to examine what e-PHI it maintains and where, why and how the CE maintains and transmits that e-PHI. OCR obtained assurances that the CE implemented the corrective actions listed. Additionally, the CE is expected to conduct a risk analysis and implement a corresponding remediation plan as required by the Security Rule, and to make certain revisions to its plan documents to comply with the Privacy Rule.