CalOptima

CalOptima experienced a misdelivery error involving COVID-19 Vaccine Health Reward letters mailed between August 4 and 19, 2021. Incorrect member addresses were matched with names, exposing names, health plan names, and vaccination status. No SSN or financial data was involved. CalOptima is remailing correct letters and adding a secondary address check.

On August 17, 2016, a departing CalOptima employee downloaded protected health information, including names, demographic data, and social security numbers for some members (including minors), to an unencrypted USB flash drive. The drive was returned to CalOptima. The organization is investigating the contents and does not believe the information was shared. CalOptima is offering credit/identity monitoring services to affected individuals.

CalOptima (CA Health Plan) reported to HHS on 2016-08-22 an Unauthorized Access/Disclosure affecting approximately 15,800 individuals (HHS portal shows 1,000 threshold entry). A departing employee impermissibly copied PHI — including names, addresses, dates of birth, claims information, diagnosis/conditions, medications, treatment info, Medicaid beneficiary numbers, and SSNs — to an unauthorized USB device on her final days of employment. The breach was detected via CalOptima's data loss prevention system. The CE notified affected individuals, media, and HHS, reported to law enforcement, and implemented corrective actions including disabling USB write privileges for all employees.