Connextions c/o Anthem BCBS

From November 11, 2011 through October 1, 2012, an employee of Connextions (a business associate of Anthem BCBS) improperly accessed the PHI of the covered entity's Medicare members and may have disclosed their Social Security numbers to a third party. Approximately 528 Indiana members were affected out of 1,678 total individuals reported to HHS. PHI involved included demographic information and SSNs. The CE notified HHS, affected individuals, and the media. Remediation included a security risk assessment, closure of the involved call center, an independent external audit, and termination of the employee. OCR reviewed the BA agreement and obtained corrective action assurances. Location: Network Server.