UnitedHealth Group health plan single affiliated covered entity

On March 2, 2010, the covered entity (CE), UnitedHealth Group, discovered that remittance forms containing member information which accompany paper checks were stolen. The invoices contained the protected health information (PHI) of over 735 individuals. The types of PHI included demographic and claims information. The CE provided breach notification to HHS, affected individuals, and the media, and provided affected individuals with credit monitoring services. Following the breach, the CE reviewed its payment and remittance information controls and notified its provider call centers to remain on a high level alert to monitor all remittance payments. OCR obtained assurances that the CE implemented the corrective actions listed above.