Mailing Vendor Blamed for Blue Cross and Blue Shield of Rhode Island Privacy Breach
Blue Cross and Blue Shield of Rhode Island (BCBSRI) is alerting 1,567 plan members that some of their protected health information has been impermissibly disclosed by one of its business associates.
A BCBSRI vendor was contracted to send explanation of benefits statements to plan members which contain summaries of the healthcare services members have received under their health plan.
However, an error was made which resulted in statements being sent to incorrect individuals. The explanation of benefits statements included members’ BCBSRI ID number, their service provider(s), the service(s) provided, and the cost of the claims.
The impermissible disclosure of PHI was attributed to an error made by the vendor when combining the explanation of benefits statements for certain individuals who are covered under the same policy. Combining the statements was intended to reduce the number of summaries received by some members.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The error resulted in some explanation of benefits statements being incorrectly combined in the mid-July mailings, which resulted in the summaries being sent to incorrect family members or other individuals in the household that were covered by the same policy.
Upon discovery of the error, BCBSRI instructed the vendor to stop combining the statements and individual summaries will continue to be sent to members while BCBSRI looks for a different solution.
BCBSRI issued a statement about the incident confirming that the error only resulted in the disclosure of PHI to family members or other individuals in the same household covered by the policy, not to any other members.
Since members’ Social Security numbers and dates of birth are not detailed in the summaries, and only family members received the summaries, the risk of any information being misused is believed to be very low.
All individuals who have been impacted by the incident will be notified about the privacy breach by mail in the next few days.
