HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Lost CD Contained Social Security Numbers of 18,854 Health Plan Members

18,854 health plan members have been notified of a potential breach of their protected health information following the loss of a compact disc in the mail.

An employee at Aetna Signature Administrators (ASA), a provider of network and management services to group health plans, mailed a CD containing sensitive health plan members’ information to another ASA employee. The CD was mailed on September 6 and the envelope was delivered on September 9; however, the CD was missing from the envelope.

The CD contained reports that had been provided to ASA by health plans or health plan administrators. The reports were used by ASA to evaluate and select programs and services for health plan members.

The reports contained the dates of birth of health plan members along with their Social Security numbers, and in some instances, names and addresses. Individuals impacted by the incident were notified of the potential ePHI breach last month.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

Since Social Security numbers were exposed, ASA has offered all affected individuals a year of identity theft protection services through Equifax (Equifax Credit Watch Gold) without charge. The services are provided as a precaution against identity theft and fraud. ASA has not received any reports to suggest the CD has been accessed or used by unauthorized individuals. Neither ASA nor the U.S. Postal Services has located the missing CD.

This is the second incident of this nature to be reported in the past week. Last week, OptumHealth New Mexico announced that a business associate had mailed an unencrypted flash drive in the mail, but it failed to arrive at its destination.

ASA has now taken the decision to stop mailing CDs containing ePHI and will use other, more secure methods of communication in the future. Staff members have also been retrained on handling sensitive health plan members’ information and health plans have been instructed not to include members’ Social Security numbers in reports submitted to ASA.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.