StayWell Health Management, LLC

On February 21, 2014, StayWell Health Management, LLC, a business associate (BA) of the covered entity (CE), Missouri Consolidated Health Care Plan, erroneously made a spreadsheet accessible via an electronic link on the internet. The spreadsheet included participants’ complete names, email addresses, unique internal identification numbers, current status in the wellness program, information regarding email notifications, and whether a participant had completed two program surveys. Approximately 10,024 individuals were affected by the breach. The BA provided breach notification to affected individuals and the media. The CE provided breach notification to HHS. Following the breach, the CE ensured that the BA removed the spreadsheet from public accessibility via the internet and implemented the use of a legacy system in order to safeguard electronic protected health information (ePHI) in transit. The CE also updated its Privacy and Security Policy, to include encryption standards for safeguarding data in process, in transit, and at rest. OCR obtained documented assurances that the CE and BA implemented the corrective actions listed above.