HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Mailing Vendor Blamed for Blue Cross and Blue Shield of Rhode Island Privacy Breach

Blue Cross and Blue Shield of Rhode Island (BCBSRI) is alerting 1,567 plan members that some of their protected health information has been impermissibly disclosed by one of its business associates.

A BCBSRI vendor was contracted to send explanation of benefits statements to plan members which contain summaries of the healthcare services members have received under their health plan.

However, an error was made which resulted in statements being sent to incorrect individuals. The explanation of benefits statements included members’ BCBSRI ID number, their service provider(s), the service(s) provided, and the cost of the claims.

The impermissible disclosure of PHI was attributed to an error made by the vendor when combining the explanation of benefits statements for certain individuals who are covered under the same policy. Combining the statements was intended to reduce the number of summaries received by some members.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

The error resulted in some explanation of benefits statements being incorrectly combined in the mid-July mailings, which resulted in the summaries being sent to incorrect family members or other individuals in the household that were covered by the same policy.

Upon discovery of the error, BCBSRI instructed the vendor to stop combining the statements and individual summaries will continue to be sent to members while BCBSRI looks for a different solution.

BCBSRI issued a statement about the incident confirming that the error only resulted in the disclosure of PHI to family members or other individuals in the same household covered by the policy, not to any other members.

Since members’ Social Security numbers and dates of birth are not detailed in the summaries, and only family members received the summaries, the risk of any information being misused is believed to be very low.

All individuals who have been impacted by the incident will be notified about the privacy breach by mail in the next few days.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.