Lost CD Contained Social Security Numbers of 18,854 Health Plan Members
18,854 health plan members have been notified of a potential breach of their protected health information following the loss of a compact disc in the mail.
An employee at Aetna Signature Administrators (ASA), a provider of network and management services to group health plans, mailed a CD containing sensitive health plan members’ information to another ASA employee. The CD was mailed on September 6 and the envelope was delivered on September 9; however, the CD was missing from the envelope.
The CD contained reports that had been provided to ASA by health plans or health plan administrators. The reports were used by ASA to evaluate and select programs and services for health plan members.
The reports contained the dates of birth of health plan members along with their Social Security numbers, and in some instances, names and addresses. Individuals impacted by the incident were notified of the potential ePHI breach last month.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Since Social Security numbers were exposed, ASA has offered all affected individuals a year of identity theft protection services through Equifax (Equifax Credit Watch Gold) without charge. The services are provided as a precaution against identity theft and fraud. ASA has not received any reports to suggest the CD has been accessed or used by unauthorized individuals. Neither ASA nor the U.S. Postal Services has located the missing CD.
This is the second incident of this nature to be reported in the past week. Last week, OptumHealth New Mexico announced that a business associate had mailed an unencrypted flash drive in the mail, but it failed to arrive at its destination.
ASA has now taken the decision to stop mailing CDs containing ePHI and will use other, more secure methods of communication in the future. Staff members have also been retrained on handling sensitive health plan members’ information and health plans have been instructed not to include members’ Social Security numbers in reports submitted to ASA.
