BLUE CROSS AND BLUE SHIELD OF KANSAS CITY

In February 2014, two members of the covered entity (CE), Blue Cross Blue Shield of Kansas City Plan, reported unauthorized charges on credit cards they used to make payments by phone to the CE. The CE determined that an employee violated its policies and procedures and may have put the financial information of 2,546 individuals at risk. The breach affected members that spoke with this employee regarding payment of premiums. The CE provided breach notification to HHS, affected individuals, and the media, and reported the matter to the FBI and local law enforcement. The CE reported that its background check contractor, Verifications Inc. (VI) provided an inaccurate criminal background check, which resulted in the hiring of the involved employee although the employee had been convicted of felony identity theft in April 2012. To prevent similar breaches from happening in the future, the CE terminated its contract with VI and established a relationship with a new background check vendor. The CE provided training to its workforce on its policies and procedures regarding HIPAA Security. OCR obtained documented evidence demonstrating that the CE implemented the corrective action listed above. The CE also ended the involved employee’s employment.