L.A. Care Health Plan

The covered entity (CE), L.A. Care Health Plan, reported that an accidental mailing error caused member identification (ID) cards to be mailed to the wrong addresses during its annual member mailing process. The mailing error potentially affected 18,000 individuals and included names, dates of birth, addresses, and zip codes. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE edited the case numbering and address verification process for print and mail jobs with its vendor. The CE revised its policies and procedures to exclude ID cards from the annual member mailing. As a result of OCR’s investigation it provided technical assistance regarding a covered entity’s obligation to conduct an accurate and thorough risk analysis and implement security measures sufficient to reduce those risks and vulnerabilities identified in the analysis.